Query: information security frameworks comparison

title: Definition and Equation Proof of Semantic Security in Information Security
abstract: Our definition of semantic security was introduced,and we tried to integrate the frameworks of definitions of semantic security,non distinguishability and non expandability by analysing semantic security in comparison based framework.This facilitates the study of relations among these goals against different attack models,and we made a slightly modified definition of classifying based on comparison and then we studied our proof of equation of semantic security and classifying in the new framework.This way makes the proof of the equation of semantic security and non distinguishability easier and more understandable.

title: AGENT BASED DATA SECURITY APPROACH FOR HYBRID CLOUD COMPUTING
abstract: Cloud Computing sees a technical and cultural shift of computing service provision from being provided locally to being provided remotely, and en masse, by third party service providers. Users have lost control over the protection of their data: No longer is our data kept under our own watchful eyes. In general, an information security approach estimates the risk, where the risk is to occur due to an unusual event, and the associated consequences for cloud organization. Information Security and Risk Management (ISRA) practices vary among cloud organizations and disciplines. There are several approaches to compare existing risk management methods for cloud organizations but their scope is limited considering stereo type criteria, rather than developing an agent based task that considers all aspects of the associated risk. It is the lack of considering all existing renowned risk management frameworks, their proper comparison, and agent techniques that motivates this research. This paper proposes Agent Based Information Security Framework for Hybrid Cloud Computing as an all inclusive method including cloud related methods to review and compare existing different renowned methods for cloud computing risk issues and by adding new tasks from surveyed methods.

title: Framework for the Comparison and Selection of Schemes for Multi Factor Authentication
abstract: Authentication is the process of verifying a user's identity for them to access a system's resources. An authentication factor is a piece of information used for this authentication. Three well known groups of authentication factors exist: knowledge based (what you know) possession based (what you have) and inherence based (what you are) Authentication schemes belonging to distinct authentication factors can be combined in a multi factor manner to increase security. Although multiple multi factor proposals are seen in literature, the absence of a method that allows a proper comparison and selection of these authentication methods, based on an application's security requirements, can be observed. Existing frameworks for the analysis of authentication methods have been identified through the realization of a systematic literature review, but most of these focus on specific contexts and do not provide a generic enough solution. Due to the above, this research focuses on the creation of a recommendation framework that guides in the comparison and selection of single and multi factor authentication schemes, considering both the application's requirements and its context. This has been attained not only through the knowledge found in literature, but the experience from industry experts has been compiled as well through the collaboration with a multinational software development company. Consequently, the knowledge found in literature has been obtained from a systematic literature review, whereas the experience from industry experts was obtained through a survey and interviews. The framework proposal has been generated based on the above and has been validated through an expert panel and a case study methodology in collaboration with the partnered software development company. A tool prototype has been constructed as well. The result is a recommendation framework for the comparison and selection of authentication methods that can support this decision process in multiple contexts.

title: Comparative Analysis of Cybersecurity Systems in Russia and Armenia: Legal and Political Frameworks
abstract: The paper compares information security policies of two countries, Russia and Armenia. Provided the common historical past, two countries have a close cultural, historical and, partially, language basis. Moreover currently both countries tightly cooperate, particularly, in political, economic, and military fields. As cases for comparison, we choose countries members to such international regional organizations, as Eurasian Economic Union (EEU) and Collective Security Treaty Organization (CSTO) In accordance with the Index of Democracy, Armenia and Russia are countries in democratic transition. However they have different approaches to information security more liberal in case of Armenia and more centralized in case of Russia. We use two levels (legal and practical) to analyze cyber strategies, institutions and experience (policies) of two countries. First of all, we provide deep and comprehensive literature review on information security. The latter is performed on the following aspects of international information security: theoretical, legal, activities of international organizations, as well as Russia and Armenia positions on these issues. Second, we analyze key theoretical concepts (information security, information warfare, etc. and approaches to them in academic and political communities. Third, we reveal basic doctrines and policy papers regulating information security policy in these states. One of the ways to evaluate information policy effectiveness is based on comparison of countries' positions in global rankings (e.g. ITU Global Cybersecurity Index) In addition the research considers official statistics data, experts' surveys, public opinion polls and media publications.

title: National frameworks and the gender pay gap in Italy, Poland and the UK. Comparing oranges with apples?
abstract: This chapter considers the legal, economic and industrial relations context with reference to the three countries on which the research focuses: Italy, Poland and the UK. As the title of the chapter suggests, drawing on Locke and Thelen's (1995) seminal article, we adopt a 'contextualised comparisons' approach to our analysis to establish how EU law on pay equality is refracted through different institutional settings. We further use the concept of functional equivalence to identify the specific issues and pressure points that have been instrumental in conceptualising and attempting to achieve equal pay and close the gender pay gap (GPG) in each country. However, to aid a more direct, 'matched comparison' and to provide contextual information important for later chapters in the book, we structure our analysis of each country under common headings covering the basic regulatory framework, case law, wage system and tax and social security frameworks as they impact on pay equality.

title: Information security risk management: a holistic framework.
abstract: ii ability of ISRM methodologies to be adapted to organisational requirements. Developed scales allow for a qualitative comparison between different methodologies. The BFME forms the basis of the Bornman Framework for ISRM Information Communication (BFIC) This communication framework communicates the status of each ISRM component. This framework can be applied to any ISRM methodology after it has been evaluated by the BFME. The Bornman Risk Console (BRC) provides a practical implementation of the BFIC. The prototype utilises an existing ISRM methodology's approach and provides decision enabling risk information to top level management. By implementing the BRC and following the processes of the BFME and BFIC the differences in the approaches at each managerial level in different organisational structures are negated. These frameworks and prototype provide a holistic communication framework that can be implemented in any organisation.

title: Semantic integration of security knowledge sources
abstract: For evaluating the security in enterprise systems, we need a security model that is amenable to integration, automated comparison and assessment. Over the years, practitioners have used various frameworks or standards (COBIT, ISO 2700x family) as checklists against which they could assess the security level in enterprise systems. On the other hand, researchers were more concerned with analysing security requirements or designing software for describing those requirements. These security models are either too general and contain unnecessary information for a particular organisation, or are highly dependent on the expertise of a security engineer. Besides these standards that are giving guidelines regarding security, there are many other sources like books, blogs, news, trainings and courses that produce security recommendations, there are regulations that mandate awareness about security, but still, organisations are missing appropriate knowledge and their systems are often attacked and breached. Having all these means available at a click of a mouse, it is questionable how can we use them in order to find the right solution that generates appropriate behaviour. This paper intends to tackle this problem by formulating a proposal for a methodology to setup a hybrid security knowledge repository for enterprise systems. The proposed solution will enable various stakeholders to add/share security knowledge in/from a repository and at the same time can use external trusted security data (from collaborative partners or reliable organisations) to enrich this knowledge base via semantic inter operability techniques. Combining various online sources with knowledge from security officers would enable inferring new insights. The security knowledge holds some key characteristics that are considered as imperative. We referred to these as the 5C: Complexity, Continuity, Comprehensive and Cross organisations, Compliance and Common representation. Our approach is making use of a common representation based on semantic technology for describing both security requirements pertaining to an organisation and trusted external security data.

title: IT Governance Frameworks and COBIT A Literature Review
abstract: IT governance is one of the central areas of IS research. This study examines research on Control Objectives for Information and Related Technology (COBIT) a popular governance framework. COBIT is a comprehensive IT governance framework that provides guidelines to IT managers in managing and governing enterprise IT. This paper compiles and analyses extant research on COBIT. Our findings suggest that researchers have examined COBIT through multiple perspectives and that most papers either concentrate on overall framework development/comparison or certain pockets of interest within COBIT such as security, risk management, systems development, effectiveness and internal control. Our survey also indicates that many of the published papers are in the accounting domain. COBIT's scope has increased over the years and now it encompasses many of the mainstream IS related areas. Hence, suggestions for future research in IS with regard to COBIT is also articulated in this study.

title: A holistic cyber security implementation framework
abstract: The purpose of this paper is to propose a holistic cyber security implementation framework (HCS IF) that lays out the ground for a conceptual, coherent, systematic, overarching and consolidated approach to implement cyber security strategies (CSSs)  The HCS IF is conceptually proposed to address the actual needs that are extracted from literature review. The HCS IF uses and integrates a set of high level conceptual security controls, solutions, processes, entities, tools, techniques or mechanisms that are already known in the domains of information security management, software engineering and project management to address the identified needs.  The HCS IF components and controls collectively interact and cooperate to implement CSSs. The proposed framework is compared with other related frameworks, and the results show that the HCS IF outperforms other frameworks on most of the suggested comparison criteria.  From a practical standpoint,

title: Efficient Security Adaptation Framework for Internet of Things
abstract: Security of Internet of Things has become a hot research topic due to their wide deployment, their huge generated information and the increasing new runtime attacks they are facing. Thereby, applications are unaware of what security mechanisms to apply, as well as how to overcome dynamic changing attacks. Accordingly, the concept that must cope with this new security challenge has to satisfy an overall performance such as power consumption, being actually a key issue for internet of things. This research investigates methods mainly based on autonomic computing and adaption security to build a Framework capable of determining appropriate security means for a highly dynamic wireless network with respect to context aware, self optimization and self protection paradigms of autonomic system. Trust computing was the means used to mitigate the influence of attackers. We have carried out a deep comparison of our Framework with many other Frameworks, mainly with autonomic system. The results clearly show that our Framework is efficient in terms of survivability, overall network utilization and power consumption.