Application of rank correlation, clustering and classification in information security

This article is devoted to experimental investigation of a novel application of a clustering technique introduced by the authors recently in order to use robust and stable consensus functions in information security, where it is often necessary to process large data sets and monitor outcomes in real time, as it is required, for example, for intrusion detection. Here we concentrate on a particular case of application to profiling of phishing websites. First, we apply several independent clustering algorithms to a randomized sample of data to obtain independent initial clusterings. Silhouette index is used to determine the number of clusters. Second, rank correlation is used to select a subset of features for dimensionality reduction. We investigate the effectiveness of the Pearson Linear Correlation Coefficient, the Spearman Rank Correlation Coefficient and the Goodman--Kruskal Correlation Coefficient in this application. Third, we use a consensus function to combine independent initial clusterings into one consensus clustering. Fourth, we train fast supervised classification algorithms on the resulting consensus clustering in order to enable them to process the whole large data set as well as new data. The precision and recall of classifiers at the final stage of this scheme are critical for the effectiveness of the whole procedure. We investigated various combinations of several correlation coefficients, consensus functions, and a variety of supervised classification algorithms.

User preference of cyber security awareness delivery methods

Operating systems and programmes are more protected these days and attackers have shifted their attention to human elements to break into the organisation's information systems. As the number and frequency of cyber-attacks designed to take advantage of unsuspecting personnel are increasing, the significance of the human factor in information security management cannot be understated. In order to counter cyber-attacks designed to exploit human factors in information security chain, information security awareness with an objective to reduce information security risks that occur due to human related vulnerabilities is paramount. This paper discusses and evaluates the effects of various information security awareness delivery methods used in improving end-users’ information security awareness and behaviour. There are a wide range of information security awareness delivery methods such as web-based training materials, contextual training and embedded training. In spite of efforts to increase information security awareness, research is scant regarding effective information security awareness delivery methods. To this end, this study focuses on determining the security awareness delivery method that is most successful in providing information security awareness and which delivery method is preferred by users. We conducted information security awareness using text-based, game-based and video-based delivery methods with the aim of determining user preferences. Our study suggests that a combined delivery methods are better than individual security awareness delivery method.

An agile IT security model for project risk assessment

There are two fundamental challenges in effectively performing security risk assessment in today's IT projects.The first is the project manager's need to know what IT security risks face the project before the project begins. At this stage IT security staff are unable to answer this question without first knowing the system requirements for the project which are yet to be defined. Second organisations that deal with a large project throughput each year find the current IT security risk assessment process to be tedious and expensive, especially when the same process has to be repeated for each individual project. This also makes it difficult for an organisation to prioritise which projects require more investment in IT security in order to fit within budget constraints. This paper presents a conceptual model that is based on an agile approach to alleviate these challenges. We do this by first analysing two online database resources of vulnerabilities by comparing them to each other, and then compare them to the agile criteria of the conceptual model which we define. The conceptual model is then presented and an example is given of how it can be applied to an actual project. We then briefly discuss what further work needs to be done to implement the conceptual model and validate it against an existing IT project.

Drugs, ships and containers : how anti-terrorism benefits shipping security

Using ships to transport illicit drugs is not new; nor is the practice of concealing them
in shipping containers decreasing – or is it? This article questions whether recent container security initiatives created to stop terrorism have also achieved a decrease in the use of containers for smuggling illicit drugs. Or, are these maritime security regimes creating a false sense of achievement, being too limited in scope to be truly useful in this secondary role? Logically, improved detection of illicit drugs in containers shipped by sea is more likely when port personnel are better trained, x-ray scanners installed, port fencing improved and official collaboration encouraged. However, since the number of containers being electronically screened and physically searched has only marginally improved, the question is, is it enough?

Contemporary security and strategy

This chapter raises the following main points:
• The study of security has experienced a series of debates around the nature of the threats to security.
• The early security scholars, as distinct from those who studied strategy and warfare, took a broad approach and argued that military and non-military means could achieve security.
• During the Cold War the study of security focused on the most pressing security issue of the day – the nuclear standoff between the two superpowers.
• In the post-Cold War era the broader approach to the study of security returned to the fore and included non-state actors and non-traditional sources of insecurity.

Regional security and regional conflict

This chapter raises the following main points:
• Regions are groupings of states that share either geographic proximity or have sufficient cultural/historic ties that bind them together.
• Regionalization occurs within a region as interdependence is developed among the regional states.
• The development of regionalism is dependent on the support of the regional great power(s), the extent of reciprocity that exists in the relations of the states in the region, and the level of strategic reassurance that exists among these states.
• Regionalization is not a lineal process, that is, it can increase or decrease.
• The pace of regionalism is different in each region but a basic pattern exists where economic integration precedes political and security integration.
• Regional threats to security can be divided into four categories. The first two comprise traditional military threats such as balance of power contests between regional powers and ‘grass fire’ conflicts between smaller powers or over more localized issues. The
third category includes, for example, intra-state conflicts for ethnic, religious, nationalist or ideological, issues. Finally, transnational threats such as environmental degradation or resource scarcity can also cause regional instability and conflict.

Does traditional security risk assessment have a future in information security?

The current information security standards still advocate the use of risk assessment in the prioritisation of security investments. However, prior research on the use of risk assessment methodologies in organisational security has shown that the use of the traditional monolithic risk assessment process described in the current risk management standard is simply not practical at the organisational level. This paper first examines the problems in performing a systematic risk assessment and then discusses the limitations of a traditional risk assessment. To address these limitations, this paper proposes splitting up the current monolithic risk assessment process. The result is an information security assessment framework that puts greater emphasis on situational awareness and allows for better decision making on the prioritization of security investments.