In last decade information security standards became well documented starting with ISO 27001:2005 which defines requirements for a organisation's Information Security Management System (ISMS). Other standards such as ISO 27004:2009,... more
In last decade information security standards became well documented starting with ISO 27001:2005 which defines requirements for a organisation's Information Security Management System (ISMS). Other standards such as ISO 27004:2009, 27003, and 27005 are published later too. Organisational ISMS can be certifies for ISO 27001:2005 certificate and it adopts Plan-Do-Check-Act (PDCA) life cycle of constant system improvements. To be able to improve operations and information security ISO 27004:2009 standard has to be used to create useful Key Performance Indicators (KPI) in order to achieve constant improvements of the ISMS. During phase of maintenance every system needs infrastructure to collect data, analyse data and then to create KPI for constant improvements. In this paper is presented information security measurement infrastructure for KPI visualisation based on practical experience from production system in financial surrounding.
International security standards used in smart grids, industrial control systems, and critical infrastructures have become important for institutions and organizations. Within the framework of these standards, it is aimed to increase the... more
International security standards used in smart grids, industrial control systems, and critical infrastructures have become important for institutions and organizations. Within the framework of these standards, it is aimed to increase the security and durability of smart networks, industrial control systems, and critical infrastructures. When determining the most useful best practice standards and guidance for implementing effective cybersecurity and information security, it is important to determine the role and scope of each, and how it will interact with other standards and guidance. Cybersecurity and information security standards are applied to all organizations in which they operate, regardless of sector and institution, regardless of their size. This study provides general information about international information and cybersecurity standards used and referenced in the detection and protection of security vulnerabilities in smart grids, industrial control systems, and critical infrastructure systems. In this study, we investigate 31 international security standards in smart grids, industrial control systems, and critical infrastructures concerning their origin country and publication date covering the years from 1971 to 2020. According to our research results, 22 security standards were developed in the USA.
This paper aims to determine the role of international standards for data security to increase the efficiency of E-Publishing over cloud computing by a case study to a sample of academics and researchers, and to achieve the objectives of... more
This paper aims to determine the role of international standards for data security to increase the efficiency of E-Publishing over cloud computing by a case study to a sample of academics and researchers, and to achieve the objectives of this paper a questionnaire was developed to gather data from samples and analyze these data by using fuzzy logic tools, it also pursuits to add knowledge to E-Publishing, its concepts and the role of information security international standards to promote E-Publishing in Arab. The researchers concluded in this paper many outcomes and the most significant one was international standards which have a crucial and important role in increasing the efficiency of E-Publishing over cloud computing via limiting the access to documents by (hackers, illegal access, unauthorized access and plagiarism) and enforces the role of control institutions to preserve researchers and authors copyright. Researchers recommend using international standards on information security to enforce E-Publishing over cloud computing, addition to that it is set up an Arabic institute to issue information, standards which are compatible with the Arabic culture and environment.
The SPEKE protocol is commonly considered one of the classic Password Authenticated Key Exchange (PAKE) schemes. It has been included in international standards (particularly, ISO/IEC 11770-4 and IEEE 1363.2) and deployed in commercial... more
The SPEKE protocol is commonly considered one of the classic Password Authenticated Key Exchange (PAKE) schemes. It has been included in international standards (particularly, ISO/IEC 11770-4 and IEEE 1363.2) and deployed in commercial products (e.g., Blackberry). We observe that the original SPEKE specification is subtly different from those defined in the ISO/IEC 11770-4 and IEEE 1363.2 standards. We show that those differences have critical security implications by presenting two new attacks on SPEKE: an impersonation attack and a key-malleability attack. The first attack allows an attacker to impersonate a user without knowing the password by engaging in two parallel sessions with the victim. The second attack allows an attacker to manipulate the session key established between two honest users without being detected. Both attacks are applicable to the original SPEKE scheme, and are only partially addressed in the ISO/IEC 11770-4 and IEEE 1363.2 standards. We highlight deficiencies in both standards and suggest concrete changes.
This paper aims to determine the role of international standards for data security to increase the efficiency of E-Publishing over cloud computing by a case study to a sample of academics and researchers, and to achieve the objectives of... more
This paper aims to determine the role of international standards for data security to increase the efficiency of E-Publishing over cloud computing by a case study to a sample of academics and researchers, and to achieve the objectives of this paper a questionnaire was developed to gather data from samples and analyze these data by using fuzzy logic tools, it also pursuits to add knowledge to E-Publishing, its concepts and the role of information security international standards to promote E-Publishing in Arab. The researchers concluded in this paper many outcomes and the most significant one was international standards which have a crucial and important role in increasing the efficiency of E-Publishing over cloud computing via limiting the access to documents by (hackers, illegal access, unauthorized access and plagiarism) and enforces the role of control institutions to preserve researchers and authors copyright. Researchers recommend using international standards on information security to enforce E-Publishing over cloud computing, addition to that it is set up an Arabic institute to issue information, standards which are compatible with the Arabic culture and environment.
ABSTRACT In last decade information security standards became well documented starting with ISO 27001:2005 which defines requirements for a organisation's Information Security Management System (ISMS). Other standards such as ISO... more
ABSTRACT In last decade information security standards became well documented starting with ISO 27001:2005 which defines requirements for a organisation's Information Security Management System (ISMS). Other standards such as ISO 27004:2009, 27003, and 27005 are published later too. Organisational ISMS can be certifies for ISO 27001:2005 certificate and it adopts Plan-Do-Check-Act (PDCA) life cycle of constant system improvements. To be able to improve operations and information security ISO 27004:2009 standard has to be used to create useful Key Performance Indicators (KPI) in order to achieve constant improvements of the ISMS. During phase of maintenance every system needs infrastructure to collect data, analyse data and then to create KPI for constant improvements. In this paper is presented information security measurement infrastructure for KPI visualisation based on practical experience from production system in financial surrounding.
