Showing papers in "Information Systems Security in 2007"
TL;DR: Understanding of pertinent issues in information security vis-a-vis technical, theoretical, managerial, and regulatory aspects of information systems is becoming increasingly important to the IT community.
Abstract: In the paradigm of Information Systems (IS), information security research has received increased attention from both academic researchers and industry practitioners alike. This intriguing phenomen...
133 citations
TL;DR: The security solution in ERP as well as directions for secure ERP systems is presented and the technology from its evolution through architecture to its products is introduced.
Abstract: Enterprise Resource Planning (ERP) is the technology that provides the unified business function to the organization by integrating the core processes. ERP now is experiencing the transformation that will make it highly integrated, more intelligent, more collaborative, web-enabled, and even wireless. The ERP system is becoming the system with high vulnerability and high confidentiality in which the security is critical for it to operate. Many ERP vendors have already integrated their security solution, which may work well internally; while in an open environment, we need new technical approaches to secure an ERP system. This paper introduces ERP technology from its evolution through architecture to its products. The security solution in ERP as well as directions for secure ERP systems is presented.
131 citations
TL;DR: A recent study surveyed 874 certified information system security professionals to determine and rank the top 25 information security issues, and found that of the 18 highest-ranked issues, 10 were more managerial in nature rather than technical.
Abstract: Organizations today know that information technology is essential not only for daily operations but also for gaining strategic advantage in the marketplace. The importance of information technology...
40 citations
TL;DR: This article tries to formulate an approach to the information security policy development that will make the policy document capture the essentials of information security as applicable to a business.
Abstract: Development of the information security policy is a critical activity. Credibility of the entire information security program of an organization depends upon a well-drafted information security policy. Most of the stakeholders do not have time or inclination to wade through a lengthy policy document. This article tries to formulate an approach to the information security policy development that will make the policy document capture the essentials of information security as applicable to a business. The document will also convey the urgency and importance of implementing the policy, not only in letter but also in spirit.
38 citations
TL;DR: The results show that the enforcement of password composition rules does not discourage users from using meaningful information in passwords, and does significantly improve protection against dictionary-based attack.
Abstract: Many systems rely on password composition rules to force users to choose more secure passwords. The findings discussed here are from a study on the enforcement of good password practice in the form of password composition rules. The results show that the enforcement of password composition rules does not discourage users from using meaningful information in passwords. While composition rules reduce password reuse, the overall incidence remains high. Passwords created under these conditions are also perceived to be more difficult to remember. Nevertheless, the enforcement of password composition rules does significantly improve protection against dictionary-based attack.
32 citations
TL;DR: An insider threat assessment is a recommended first step for many organizations, followed by review of relevant security policies and employee awareness training.
Abstract: Insiders — employees, contractors, consultants, and vendors — pose as great a threat to an organization's security posture as outsiders, including hackers. Few organizations have implemented the po...
28 citations
TL;DR: Critical barriers in implementing RFID technologies, specifically for authentication and privacy in an RFID tagged world, are outlined, and a set of initial responses are provided, including a new scheme (Veri-RFID) for consumer privacy, that would assist in the process to overcome these challenges.
Abstract: Radio Frequency Identification (RFID) technologies have increasing visibility in the business processes: automating inventory management (supply chains), facilitating innovation, and increasing competitiveness. Since the potential applications of RFID systems are numerous, it is essential to address the industry and consumer perspective issues that have resulted in barriers to RFID implementation. This paper outlines critical barriers in implementing RFID technologies, specifically for authentication and privacy in an RFID tagged world, and provides organizational leaders with a set of initial responses, including a new scheme (Veri-RFID) for consumer privacy, that would assist in the process to overcome these challenges.
27 citations
TL;DR: The invention relates to a horizontal tank-type container, particularly for use in winemaking, the beverage industry and the preparation of alcohol, which resides in the container being pear-shaped or escutcheon-shaped in cross section normal to the longitudinal container axis.
Abstract: The chief executive officer (CEO), chief information officer (CIO), and chief information security officer (CISO) walk into a bar. The CEO orders a light beer. The CIO normally orders his full-bodi...
26 citations
TL;DR: This article will review some of the basic issues that relate to information security process automation, including turning security policies into security requirements; challenges in enforcingSecurity requirements; what’s involved in automating information security and compliance processes; and how a security process Automation platform supports that effort.
Abstract: A favorite idiom among security experts is, “Security isn't a product, it's a process.”1 If security is a process, then why not automate it? Today's workflow and business process management (BPM) t...
25 citations
TL;DR: The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards—and even then I have my doubts.
Abstract: "The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards-and even then I have my doubts."-Gene Spafford, Professor of Computer Science, Purdue University
18 citations
TL;DR: This article originally published in EDPACS 35(2), February 2007, pp 11–17 is republished here for the sake of completeness.
Abstract: Companies have now weathered several years of scrutiny under regulatory requirements with the inception of HIPAA, Sarbanes Oxley, and other industry regulations. To meet these compliance challenges, many companies have looked to different frameworks to help build controls structures within the organization. For IT organizations, this has required a shift in mindset to adopt a "controls oriented" approach while keeping up with the technology needs of the business. A key to the adoption of any framework has been ensuring the approach is applicable to your business.
TL;DR: A brief history of the development of rootkits and their possible effects is presented, along with an overview of methods to prevent rootKits and to eradicate one that has infected an operating system.
Abstract: A rootkit is cloaked software that infiltrates an operating system or a database with the intention to escape detection, resist removal, and perform a specific operation. Many rootkits are designed to invade the "root," or kernel, of the program, and therefore operate without announcing their presence to the owner of the computer. Although some rootkits are written with noble intentions (e.g., to strengthen an anti-virus package), true rootkits have a malicious purpose. A rootkit infection can render a compromised computer system vulnerable to attacks and corruption. Rootkits are named for their origin in Linux systems, but the number of rootkits that attack Microsoft operating systems has recently proliferated. Not only are rootkits difficult to detect and assess, but at times the only effective way to remove them is to do a clean installation of the entire operating system. Recent discoveries of rootkits in other venues prove that the problem is spreading and is a major concern for administrators in information security. This paper presents a brief history of the development of rootkits and their possible effects.Prominent cases involving rootkits are described.The paper concludes with an overview of methods to prevent rootkits and to (hopefully) eradicate one that has infected an operating system.
TL;DR: Character is doing the right thing when nobody is looking as mentioned in this paper... There are too many people who think that … the only thing that's wrong is to get caught. J.C. Watts
Abstract: Character is doing the right thing when nobody is looking. There are too many people who think that … the only thing that's wrong is to get caught. J.C. Watts The public disgrace and downfall of on...
TL;DR: The concepts of ownership rights and related intellectual property rights and their technical and legal protection measures are explained and digital water marking is introduced, its classification, features, and applications.
Abstract: With the advancement of Internet technologies and its wide usage, it has become easy to illegally copy, distribute, and manipulate digital products. Digital watermarking is a proven method to protect authenticity by identifying the owner of the digital content. Significant work has been reported in the last five years on legal and technical measures for protecting digital rights. This paper explains the concepts of ownership rights and related intellectual property rights and their technical and legal protection measures. It also introduces digital water marking, its classification, features, and applications.
TL;DR: This paper will argue that the art of deception is a reliable and cost effective technique that can assure the security of an infrastructure.
Abstract: For each layer of information security there is a number of techniques and tools that can be used to ensure information superiority. Indeed some experts would argue that you cannot have the former without the latter. In today's technological & interconnected world, however, information superiority is very hard to achieve and almost impossible to maintain. This paper will argue that the art of deception is a reliable and cost effective technique that can assure the security of an infrastructure. The paper will conclude by presenting a technical solution of the above statement.
TL;DR: A stencil printer for printing the underside of a web including a vertically reciprocable upwardly opening printing head or receptacle mounted beneath a web to be printed, a reservoir for ink in a lower region of the receptacle, a printing pad in an upper region in fluid communication with the reservoir and presented upwardly through the reservoir opening for printing through a stencil on the printing pad.
TL;DR: Common criteria is used to derive the security functional components for a multipolicy-based network computing environment and supports the claims that the proposed network security policy interpretation framework is a complete and cohesive set of requirements.
Abstract: It is difficult to define reliable security policy components that should be applied to validate a secure computing environment. The job gets further complicated when one has to deal with multiple policies in single computing environment. This paper demonstrates how we can overcome the difficulties of defining reliable security components by using evaluation criteria. In this paper we use common criteria to derive the security functional components for a multipolicy-based network computing environment. In the verification process, the derived policy components are related to the specific security objectives of the network communication environment. The evidence listed in the case study supports the claims that the proposed network security policy interpretation framework is a complete and cohesive set of requirements.
TL;DR: A study on the performance comparison of cryptographic Application Program Interfaces that are implemented for the Java and the .Net frameworks indicates the superiority of a set of commercial cryptographic APIs over its open-source counterpart.
Abstract: The unprecedented growing demands on security and privacy protection ushered the proliferation of cryptographic tools. This article presents a study on the performance comparison of cryptographic Application Program Interfaces (APIs) that are implemented for the Java and the.Net frameworks. The results of the study clearly indicate the superiority of a set of commercial cryptographic APIs over its open-source counterpart.
TL;DR: Using details from more than 860 security evaluations, this paper looks at the types of products evaluated, the “assurance levels” achieved, where the evaluations occur, and ongoing participation by product vendors.
Abstract: Government-endorsed security evaluations, like those performed under the Common Criteria (CC), use established techniques of software quality assurance to try to evaluate product security. Despite high costs and disputed benefits, the number of evaluated products has grown dramatically since 2001, doubling between 2003 and 2005 and leaping again in 2006. Using details from more than 860 security evaluations, this paper looks at the types of products evaluated, the "assurance levels" achieved, where the evaluations occur, and ongoing participation by product vendors. These observations are combined with other lessons learned to make recommendations on product evaluation strategies.
TL;DR: This article originally published as “Change Management” in EDPACS, 2005, 33(4):12–24 is republished here because it is too soon to know whether this paper will be used in the classroom or not.
Abstract: This article originally published as “Change Management” in EDPACS, 2005, 33(4):12–24.
TL;DR: This article deals with vulnerability disclosure, where the details of a security breach are freely available, and with the bizarre case of Bret McDanel, a young computer expert who spent 16 months in federal prison after he exposed a security Breach in his former employer's software package.
Abstract: Given the virtually instantaneous and worldwide dissemination widely available via the Internet, the only rational assumption is that once a computer program capable of bypassing such an access con...
TL;DR: In this article, the authors explore some techniques for building management commitment through the implementation of a successful information security council, which is an excellent mechanism for establishing buy-in across middle management, and subsequently senior management and the end...
Abstract: One of the most common concerns voiced at the various security conferences and security associations around the country is: “How do we get our management to understand the importance of information security?” Individuals who have been unable to secure the attention or financial commitment from the senior leadership of their respective organizations typically voice these concerns. The question is usually accompanied by frustration as a result of multiple attempts to obtain budget, only to be faced with flat budgets, cuts to the current expenditure levels, or the elimination of separate information security budgets. Each organization has different values, principles, and strategies to move the business forward. This article explores some techniques for building management commitment through the implementation of a successful information security council. Security councils provide an excellent mechanism for establishing buy-in across middle management, and subsequently senior management and the end ...
TL;DR: A look from inside the antivirus laboratory at current malware attacks and technology developments for effective defenses is provided.
Abstract: Cyber-crime and malware has evolved so drastically over the last two years that it is a challenge for an IT professional to stay on top of recent malware trends and technological advances in cyber-security. This paper provides a look from inside the antivirus laboratory at current malware attacks and technology developments for effective defenses.
TL;DR: Taylor and Francis shall not be liable for any losses, actions, claims, proceedings, demands, costs, expenses, damages, and other liabilities whatsoever or howsoever caused arising directly or indirectly in connection with, in relation to or arising out of the use of the Content.
Abstract: It's not true that life is one damn thing after another; it is one damn thing over and over.—Edna St. Vincent Millay (1892–1950) Security and privacy experts agree any new technology is always one ...
TL;DR: IBE, a new encryption technology that uses such identity information as an encryption key, promises to provide a way to use an IAM infrastructure to address the challenges of maintaining the privacy of sensitive corporate data.
Abstract: The complex regulatory environment in which businesses currently operates is difficult to understand. It is a bewildering array of legislation that requires the protection of many types of data, or...
TL;DR: The risk of damaging cyber-attacks on corporate networks has never been higher and everything a company creates or does manifests itself within the corporate network, resulting in fertile ground for abuse and theft.
Abstract: The risk of damaging cyber-attacks on corporate networks has never been higher. Enterprise networks contain the most precious assets of a corporation. Essentially, everything a company creates or does manifests itself within the corporate network. Consequently, corporate networks have become fertile ground for abuse and theft.
TL;DR: The machine comprises a mechanical type of device effective to control the falling of the formed pastry pieces on the pans and a rotating brush device for bending the pieces according to a predetermined curvature.
Abstract: The machine comprises a dough flattening out station, a puff-pastry cutting station, a cut puff-pastry triangle spacing and orienting station, a triangle aligning station and a forming station, wherein a plurality of conveyor apparatus are provided effective to convey baking pans under the forming station, in such a way as to cause the pastry pieces to orderly fall into shaped recesses formed in the pans. The machine further comprises a mechanical type of device effective to control the falling of the formed pastry pieces on the pans and a rotating brush device for bending the pieces according to a predetermined curvature.
TL;DR: A tilting table includes a table top attached to an upper U-shaped bracket that is rotatively attached by a bearing to a base and a pair of opposed side angle slots that include a plurality of notches.
Abstract: Henry Stinson was Herbert Hoover's secretary of state in 1929 when he learned that American cryptographers had deciphered Japan's diplomatic cables. “Gentlemen,” he decreed, “do not read each other...
TL;DR: To minimize service interruption during ongoing secure sessions of mobile users, an approach based on the well-known Internet Protocol Security (IPSec) standard is presented, with empirical performance results demonstrating a packet loss improvement and a handoff delay improvement validating the high efficiency of this proposed approach.
Abstract: Recent advances in mobile computing and wireless communication technologies are enabling high mobility and flexibility of anytime, anywhere service access for mobile users. As a result, network connections of such users often span over heterogeneous networking environments consisting of wired and wireless networking technologies. Both network heterogeneity and user mobility make the securing of data transmission over heterogeneous networks challenging and complex. In this paper, we focus on the challenge of providing secure end-to-end network transmissions to wireless mobile users. To minimize service interruption during ongoing secure sessions of mobile users, we present the design and implementation of an approach based on the well-known Internet Protocol Security (IPSec) standard. We conducted a performance evaluation of our implementation using a Voice over IP (VoIP) application over an actual network testbed. Our empirical performance results demonstrate a packet loss improvement of 17% to 34% (for various VoIP packet sizes) and a handoff delay improvement of almost 24% validating the high efficiency of our proposed approach.