Information attacks and security in wireless sensor networks of industrial SCADA systems

工业SCADA系统无线传感器网络中的信息攻击与安全

Journal of Industrial Information Integration, Volume 5, March 2017, Pages 6-16

Alexey G. Finogeev, Anton A. Finogeev

Abstract:The effectiveness of automated process control systems (APCS) and supervisory control and data acquisition systems (SCADA) information security depends on the applied protection technologies of transport environment data transmission components. This article investigates the problems of detecting attacks in wireless sensor networks (WSN) of SCADA systems. As a result of analytical research the authors developed the detailed classification of external attacks and intrusion detection in sensor networks and brought a detailed description of attacking impacts on components of SCADA systems in accordance with the selected directions of attacks. The cryptographic encryption tasks in the wireless sensor networks have been resolved by means of the built-in mechanism for symmetric AES encryption with 128 bit keys according to the ZigBee Pro Feature Set specification. However, analysis of the current state in the field of security of wireless sensor networks has shown that the key management problem is almost no solved. The article considers the problems and objectives of key management for data encryption in wireless sensor networks (WSN) of SCADA systems. The structure of the key information in the ZigBee network and methods of keys obtaining are discussed. The use of a hybrid key management schemes is most suitable for WSN. The session symmetric key is used to encrypt the sensor data, asymmetric keys are used to encrypt the session key transmitted from the routing information. Three algorithms of hybrid key management using routing information frames determined by routing methods and the WSN topology are presented.

Practice-based discourse analysis of information security policies

基于实践的信息安全政策语篇分析

Computers & Security, Volume 67, June 2017, Pages 267-279

Fredrik Karlsson, Karin Hedström, Göran Goldkuhl

Abstract:To address the “insider” threat to information and information systems, an information security policy is frequently recommended as an organisational measure. However, having a policy in place does not necessarily guarantee information security. Employees' poor compliance with information security policies is a perennial problem for many organisations. It has been shown that approximately half of all security breaches caused by insiders are accidental, which means that one can question the usefulness of current information security policies. We therefore propose eight tentative quality criteria in order to support the formulation of information security policies that are practical from the employees' perspective. These criteria have been developed using practice-based discourse analysis on three information security policy documents from a health care organisation.

Applications of social network analysis in behavioural information security research: Concepts and empirical analysis

社会网络分析在行为信息安全研究中的应用：概念与实证分析

Computers & Security, Volume 68, July 2017, Pages 1-15

Duy Dang-Pham, Siddhi Pittayachawan, Vince Bruno

Abstract: The rapid digital transformation and technological disruption in modern organisations demand the development of people-centric security workplaces, whereby the employees can build up their security awareness and accountability for their actions via participation in the organisation's social networks. The social network analysis approach offers a wide array of analytical capabilities to examine in-depth the interactions and relations within an organisation, which assists the development of such security workplaces. This paper proposes the novel and practical adoption of social network analysis methods in behavioural information security field. To this end, we discuss the core features of the social network analysis approach and describe their empirical applications in a real case study of a large organisation in Vietnam, which utilised these methods to improve employees' information security awareness. Towards the end of the paper, a framework detailing the strategies for conducting social network analysis in the behavioural information security field is developed and presented.

Individual differences and Information Security Awareness

个体差异与信息安全意识

Computers in Human Behavior, Volume 69, April 2017, Pages 151-156

Agata McCormac, Tara Zwaans, Kathryn Parsons, Dragana Calic, Marcus Butavicius, Malcolm Pattinson

Abstract: The main purpose of this study was to examine the relationship between individuals' Information Security Awareness (ISA) and individual difference variables, namely age, gender, personality and risk-taking propensity. Within this study, ISA was defined as individuals' knowledge of what policies and procedures they should follow, their understanding of why they should adhere to them (their attitude) and what they actually do (their behaviour). This was measured using the Human Aspects of Information Security Questionnaire (HAIS-Q). Individual difference variables were examined via a survey of 505 working Australians. It was found that conscientiousness, agreeableness, emotional stability and risk-taking propensity significantly explained variance in individuals’ ISA, while age and gender did not. Findings highlighted the need for future research to examine individual differences and their impact on ISA. Results of the study can be applied by industry to develop tailored InfoSec training programs.