首页 > 最新文献

IEEE 37th Annual 2003 International Carnahan Conference onSecurity Technology, 2003. Proceedings.最新文献

英文 中文
Evaluation of information security related risks of an organization: the application of the multicriteria decision-making method 组织的信息安全相关风险评估:多准则决策方法的应用
Bao-Chyuan Guan, Chi-Chun Lo, Ping Wang, Jaw-Shi Hwang
In the wake of the fast popularization of information and the rise of electronic commerce, information security is gaining much attention. How to perform the evaluation of the value of assets, how to perform the analysis of the risks associated with assets, and how to protect information assets from sabotage, theft and tamper are important topics in the study of the management of information security. We address the aspects of confidentiality, integrity and availability of information and apply the Analytic Hierarchy Process (AHP) to consolidate expert's opinions on information risks, in order to construct an integrated framework for risk analysis. The BS7799 standard and the risk level matrix (RLM) are used accordingly to evaluate the effectiveness of and to categorize the risk management measures and to create a complete model for the assessment of information assets related risks. Finally, the research results are verified by a case study. The results can be used by organizations as references for information security planning and management process improvements.
随着信息的快速普及和电子商务的兴起,信息安全受到越来越多的关注。如何对资产价值进行评估,如何对与资产相关的风险进行分析,如何保护信息资产不被破坏、盗窃和篡改,是信息安全管理研究的重要课题。我们从信息的保密性、完整性和可用性三个方面着手,运用层次分析法(AHP)整合专家对信息风险的意见,构建一个综合的风险分析框架。根据BS7799标准和风险等级矩阵(RLM)对风险管理措施的有效性进行评价和分类,并为信息资产相关风险的评估创建一个完整的模型。最后,通过一个案例对研究结果进行了验证。其结果可被组织用作信息安全规划和管理过程改进的参考。
{"title":"Evaluation of information security related risks of an organization: the application of the multicriteria decision-making method","authors":"Bao-Chyuan Guan, Chi-Chun Lo, Ping Wang, Jaw-Shi Hwang","doi":"10.1109/CCST.2003.1297555","DOIUrl":"https://doi.org/10.1109/CCST.2003.1297555","url":null,"abstract":"In the wake of the fast popularization of information and the rise of electronic commerce, information security is gaining much attention. How to perform the evaluation of the value of assets, how to perform the analysis of the risks associated with assets, and how to protect information assets from sabotage, theft and tamper are important topics in the study of the management of information security. We address the aspects of confidentiality, integrity and availability of information and apply the Analytic Hierarchy Process (AHP) to consolidate expert's opinions on information risks, in order to construct an integrated framework for risk analysis. The BS7799 standard and the risk level matrix (RLM) are used accordingly to evaluate the effectiveness of and to categorize the risk management measures and to create a complete model for the assessment of information assets related risks. Finally, the research results are verified by a case study. The results can be used by organizations as references for information security planning and management process improvements.","PeriodicalId":344868,"journal":{"name":"IEEE 37th Annual 2003 International Carnahan Conference onSecurity Technology, 2003. Proceedings.","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121375012","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 24
Cryptanalysis of a fingerprint-based remote user authentication scheme using smart cards 基于指纹的智能卡远程用户认证方案的密码分析
Bin-Tsan Hsieh, Her-Tyan Yeh, Hung-Min Sun
A remote user authentication scheme is a procedure for a server to authenticate a remote user in a network. Recently, Lee et al. proposed a fingerprint-based remote user authentication scheme to overcome the security flaw in Hwang and Li's scheme. In Lee et al.'s authentication scheme, they store two secret keys and some public elements in a smart card. We first review Lee et al.'s fingerprint-based user authentication scheme. Next, we show that Lee et al.'s scheme still suffers from the impersonation attack.
远程用户身份验证方案是服务器对网络中的远程用户进行身份验证的过程。最近,Lee等人提出了一种基于指纹的远程用户认证方案,以克服Hwang和Li方案中的安全漏洞。在Lee等人的认证方案中,他们在一张智能卡中存储了两个密钥和一些公共元素。我们首先回顾Lee等人的基于指纹的用户认证方案。接下来,我们证明了Lee等人的方案仍然遭受冒充攻击。
{"title":"Cryptanalysis of a fingerprint-based remote user authentication scheme using smart cards","authors":"Bin-Tsan Hsieh, Her-Tyan Yeh, Hung-Min Sun","doi":"10.1109/CCST.2003.1297584","DOIUrl":"https://doi.org/10.1109/CCST.2003.1297584","url":null,"abstract":"A remote user authentication scheme is a procedure for a server to authenticate a remote user in a network. Recently, Lee et al. proposed a fingerprint-based remote user authentication scheme to overcome the security flaw in Hwang and Li's scheme. In Lee et al.'s authentication scheme, they store two secret keys and some public elements in a smart card. We first review Lee et al.'s fingerprint-based user authentication scheme. Next, we show that Lee et al.'s scheme still suffers from the impersonation attack.","PeriodicalId":344868,"journal":{"name":"IEEE 37th Annual 2003 International Carnahan Conference onSecurity Technology, 2003. Proceedings.","volume":"96 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124870055","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 17
Detecting offensive routers: a straightforward approach 检测攻击性路由器:一个简单的方法
B.-T. Wang, H. Schulzrinne
Packet dropping attack (PDA) is a network attack that utilizes compromised network elements to degrade network performance or quality by intentionally dropping a certain amount of IP packets. The major distinction of the PDA from traditional denial-of service (DoS) attack is that some victims do not even discern that they are under attack. Offensive router detection (ORD) is a mechanism capable of detecting offensive routers that are performing the PDA. The ORD mechanism is based on the principle of conservation of flow in the network, and employs a new proposed ICMP message, Caddie message, which records packet forwarding information in the Caddie messages. Therefore, after analyzing the information, we can identify routers that are abnormally dropping packets. We show the advantages of the ORD mechanism over other existing network monitoring mechanisms and discusses storage and bandwidth overhead issues. We also demonstrate the advantages and the effectiveness of the approach by simulating the functionality of the ORD mechanism to detect four different packet-dropping patterns.
丢包攻击(Packet drop attack, PDA)是一种利用受损的网元,故意丢弃一定数量的IP报文,从而降低网络性能或质量的网络攻击。PDA与传统的拒绝服务(DoS)攻击的主要区别在于,一些受害者甚至没有意识到他们正在受到攻击。攻击性路由器检测(ORD)是一种能够检测正在执行PDA的攻击性路由器的机制。ORD机制基于网络中流量守恒的原则,采用了一种新提出的ICMP报文——Caddie报文,在Caddie报文中记录报文的转发信息。因此,通过分析这些信息,我们可以识别出异常丢包的路由器。我们展示了ORD机制相对于其他现有网络监控机制的优势,并讨论了存储和带宽开销问题。我们还通过模拟ORD机制的功能来检测四种不同的数据包丢弃模式,从而证明了该方法的优点和有效性。
{"title":"Detecting offensive routers: a straightforward approach","authors":"B.-T. Wang, H. Schulzrinne","doi":"10.1109/CCST.2003.1297604","DOIUrl":"https://doi.org/10.1109/CCST.2003.1297604","url":null,"abstract":"Packet dropping attack (PDA) is a network attack that utilizes compromised network elements to degrade network performance or quality by intentionally dropping a certain amount of IP packets. The major distinction of the PDA from traditional denial-of service (DoS) attack is that some victims do not even discern that they are under attack. Offensive router detection (ORD) is a mechanism capable of detecting offensive routers that are performing the PDA. The ORD mechanism is based on the principle of conservation of flow in the network, and employs a new proposed ICMP message, Caddie message, which records packet forwarding information in the Caddie messages. Therefore, after analyzing the information, we can identify routers that are abnormally dropping packets. We show the advantages of the ORD mechanism over other existing network monitoring mechanisms and discusses storage and bandwidth overhead issues. We also demonstrate the advantages and the effectiveness of the approach by simulating the functionality of the ORD mechanism to detect four different packet-dropping patterns.","PeriodicalId":344868,"journal":{"name":"IEEE 37th Annual 2003 International Carnahan Conference onSecurity Technology, 2003. Proceedings.","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128426475","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Light-weight authentication and billing in mobile communications 移动通信中的轻量级认证和计费
Hsing-Bai Chen, Sue-Chen Hsueh
We present an efficient scheme for mobile devices to conduct transactions demanding high security. The use of cryptographic mechanisms is minimized by applying block-ciphers and one-way hash primitives, which can be operated with low-end processors and very little working space. Undeniable billing can be achieved by applying one-way hash chains. Owing to one-way hash functions, the integrity of the masked transactions and the billing information can be verified, even when the masked information is transmitted in public. Complicated cryptographic mechanisms, also the regulations among roaming countries, thus can be eliminated so that a light-weight billing can be achieved.
我们提出了一种高效的方案,用于移动设备进行要求高安全性的交易。通过应用块密码和单向散列原语,可以最大限度地减少加密机制的使用,这可以用低端处理器和非常小的工作空间进行操作。不可否认的计费可以通过应用单向哈希链来实现。由于单向哈希函数,即使在公开传输掩码信息时,也可以验证掩码交易和计费信息的完整性。因此,可以消除复杂的加密机制,以及漫游国家之间的规定,从而实现轻量级计费。
{"title":"Light-weight authentication and billing in mobile communications","authors":"Hsing-Bai Chen, Sue-Chen Hsueh","doi":"10.1109/CCST.2003.1297567","DOIUrl":"https://doi.org/10.1109/CCST.2003.1297567","url":null,"abstract":"We present an efficient scheme for mobile devices to conduct transactions demanding high security. The use of cryptographic mechanisms is minimized by applying block-ciphers and one-way hash primitives, which can be operated with low-end processors and very little working space. Undeniable billing can be achieved by applying one-way hash chains. Owing to one-way hash functions, the integrity of the masked transactions and the billing information can be verified, even when the masked information is transmitted in public. Complicated cryptographic mechanisms, also the regulations among roaming countries, thus can be eliminated so that a light-weight billing can be achieved.","PeriodicalId":344868,"journal":{"name":"IEEE 37th Annual 2003 International Carnahan Conference onSecurity Technology, 2003. Proceedings.","volume":"62 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128538789","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 12
Audio content based feature extraction on subband domain 基于子带域的音频内容特征提取
J.-R.J. Shieh
Content-based audio feature extraction is key to obtaining important message from audio information. Research in the past several years has focused on the use of speech recognition techniques that are not directly applicable to compressed audio bit stream. However, subband coding based MPEG-1 audio layer III (MP3) is now useful for any system with limited channel capacity for its high quality to bit rate ratio. It has been widely adopted in audio-on-demand, music link via ISDN and digital satellite broadcasting. Message collection is easier if audio content can be extract directly on subband domain. Several useful algorithms are proposed here to manifest this idea.
基于内容的音频特征提取是从音频信息中获取重要信息的关键。过去几年的研究主要集中在不能直接应用于压缩音频比特流的语音识别技术上。然而,基于子带编码的MPEG-1音频层III (MP3)由于其高质量比特率比,现在对任何信道容量有限的系统都很有用。它已被广泛应用于音频点播、ISDN音乐链路和数字卫星广播中。如果音频内容可以直接在子带域上提取,则消息收集将更加容易。这里提出了几个有用的算法来说明这个想法。
{"title":"Audio content based feature extraction on subband domain","authors":"J.-R.J. Shieh","doi":"10.1109/CCST.2003.1297618","DOIUrl":"https://doi.org/10.1109/CCST.2003.1297618","url":null,"abstract":"Content-based audio feature extraction is key to obtaining important message from audio information. Research in the past several years has focused on the use of speech recognition techniques that are not directly applicable to compressed audio bit stream. However, subband coding based MPEG-1 audio layer III (MP3) is now useful for any system with limited channel capacity for its high quality to bit rate ratio. It has been widely adopted in audio-on-demand, music link via ISDN and digital satellite broadcasting. Message collection is easier if audio content can be extract directly on subband domain. Several useful algorithms are proposed here to manifest this idea.","PeriodicalId":344868,"journal":{"name":"IEEE 37th Annual 2003 International Carnahan Conference onSecurity Technology, 2003. Proceedings.","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132260837","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
A simple key agreement protocol 一个简单的密钥协议协议
Eun-Kyung Ryu, Kee-Won Kim, K. Yoo
We propose a simple key agreement protocol(SKA) that provides key establishment with authentication over an insecure channel using only a human memorable password. The SKA is based on Diffie-Hellman scheme and has many of desirable security attributes: it resists off-line dictionary attacks mounted by either passive or active adversaries over network, allowing low-entropy passwords to be used safely. It also offers perfect forward secrecy, which protects past sessions and passwords against future compromise. Besides, it is secure against an adversary who captured a host's password file. Since user passwords are stored in a verifier form, the adversary cannot use it directly to compromise security. The proposed scheme here shows that it is more efficient in computational time and communication overhead over the existing schemes.
我们提出了一个简单的密钥协议(SKA),该协议仅使用人类可记忆的密码在不安全的通道上提供密钥建立和身份验证。SKA基于Diffie-Hellman方案,具有许多理想的安全属性:它可以抵抗网络上被动或主动对手发起的离线字典攻击,允许安全使用低熵密码。它还提供了完美的前向保密,可以保护过去的会话和密码免受未来的泄露。此外,它对于捕获主机密码文件的攻击者来说是安全的。由于用户密码以验证器形式存储,攻击者不能直接使用它来破坏安全性。本文提出的方案在计算时间和通信开销方面比现有方案更有效。
{"title":"A simple key agreement protocol","authors":"Eun-Kyung Ryu, Kee-Won Kim, K. Yoo","doi":"10.1109/CCST.2003.1297548","DOIUrl":"https://doi.org/10.1109/CCST.2003.1297548","url":null,"abstract":"We propose a simple key agreement protocol(SKA) that provides key establishment with authentication over an insecure channel using only a human memorable password. The SKA is based on Diffie-Hellman scheme and has many of desirable security attributes: it resists off-line dictionary attacks mounted by either passive or active adversaries over network, allowing low-entropy passwords to be used safely. It also offers perfect forward secrecy, which protects past sessions and passwords against future compromise. Besides, it is secure against an adversary who captured a host's password file. Since user passwords are stored in a verifier form, the adversary cannot use it directly to compromise security. The proposed scheme here shows that it is more efficient in computational time and communication overhead over the existing schemes.","PeriodicalId":344868,"journal":{"name":"IEEE 37th Annual 2003 International Carnahan Conference onSecurity Technology, 2003. Proceedings.","volume":"174 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131062982","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 9
An intelligent real-time fire-detection method based on video processing 一种基于视频处理的智能实时火灾探测方法
Thou-Ho Chen, Cheng-Liang Kao, S. Chang
To achieve fully automatic surveillance of fires, an intelligent real-time fire detection method based on a 2-stage decision strategy of video processing is proposed. The first decision stage is to check if there is a existing fire by extracting fire-pixels from visual images. In color image processing, the RGB (red, green, blue) color model has less computational complexity than other color models and hence is adopted to describe fire pixels. The decision function of fire-pixels can be deduced by the saturation of R component and fire's dynamic features. In the second decision stage, if the number of extracted fire pixels is increasing with burning time and greater than someone threshold during a time interval, a fire alarm is given to avoid leading to a disaster. To reduce false-alarm rate, the second decision process is repeated with several times at an adaptive thresholding way. Experimental results demonstrate that the proposed method is very attractive for the important military, social security, forest-fire alarm, commercial applications, and so on.
为实现火灾的全自动监控,提出了一种基于视频处理两阶段决策策略的火灾智能实时探测方法。第一个决策阶段是通过从视觉图像中提取火像素来检查是否存在火灾。在彩色图像处理中,RGB(红、绿、蓝)颜色模型的计算复杂度低于其他颜色模型,因此采用RGB模型来描述5个像素点。根据R分量的饱和度和火的动态特征,推导出火像元的判定函数。在第二个决策阶段,如果提取的火灾像素随着燃烧时间的增加而增加,并且在一段时间间隔内大于某一阈值,则会发出火灾警报,以避免导致灾难。为了降低误报率,采用自适应阈值法多次重复二次决策过程。实验结果表明,该方法在重要的军事、社会保障、森林火灾报警、商业应用等方面具有很大的吸引力。
{"title":"An intelligent real-time fire-detection method based on video processing","authors":"Thou-Ho Chen, Cheng-Liang Kao, S. Chang","doi":"10.1109/CCST.2003.1297544","DOIUrl":"https://doi.org/10.1109/CCST.2003.1297544","url":null,"abstract":"To achieve fully automatic surveillance of fires, an intelligent real-time fire detection method based on a 2-stage decision strategy of video processing is proposed. The first decision stage is to check if there is a existing fire by extracting fire-pixels from visual images. In color image processing, the RGB (red, green, blue) color model has less computational complexity than other color models and hence is adopted to describe fire pixels. The decision function of fire-pixels can be deduced by the saturation of R component and fire's dynamic features. In the second decision stage, if the number of extracted fire pixels is increasing with burning time and greater than someone threshold during a time interval, a fire alarm is given to avoid leading to a disaster. To reduce false-alarm rate, the second decision process is repeated with several times at an adaptive thresholding way. Experimental results demonstrate that the proposed method is very attractive for the important military, social security, forest-fire alarm, commercial applications, and so on.","PeriodicalId":344868,"journal":{"name":"IEEE 37th Annual 2003 International Carnahan Conference onSecurity Technology, 2003. Proceedings.","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129392588","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 118
From Web server security to Web components security 从Web服务器安全到Web组件安全
Sheng Lin
Web servers are increasingly being adopted as a viable means to access Internet-based applications. Current solutions to secure Web servers are not comprehensive or robust enough to protect servers and applications from today's hackers. Protection profile gives us a systematic approach to examine the minimum-security requirements of a system. Therefore, we derive the Web security components that make a secure Web serve from the Web Server Protection Profile. A component-based framework as well as an open source solution is given subsequently. We believe that after the system is implemented and deployed, it functions reliably and effectively. We aim at establishing the provable reliability of construction and the feasibility of component-based solutions for the secure Web server.
越来越多的人采用Web服务器作为访问基于internet的应用程序的可行手段。当前用于保护Web服务器的解决方案不够全面,也不够健壮,无法保护服务器和应用程序免受当今黑客的攻击。保护配置文件为我们提供了一种系统的方法来检查系统的最低安全要求。因此,我们从Web服务器保护配置文件派生出构建安全Web服务的Web安全组件。随后给出了基于组件的框架和开源解决方案。我们认为,系统实施部署后,运行可靠、有效。我们的目标是为安全Web服务器建立可证明的构建可靠性和基于组件的解决方案的可行性。
{"title":"From Web server security to Web components security","authors":"Sheng Lin","doi":"10.1109/CCST.2003.1297556","DOIUrl":"https://doi.org/10.1109/CCST.2003.1297556","url":null,"abstract":"Web servers are increasingly being adopted as a viable means to access Internet-based applications. Current solutions to secure Web servers are not comprehensive or robust enough to protect servers and applications from today's hackers. Protection profile gives us a systematic approach to examine the minimum-security requirements of a system. Therefore, we derive the Web security components that make a secure Web serve from the Web Server Protection Profile. A component-based framework as well as an open source solution is given subsequently. We believe that after the system is implemented and deployed, it functions reliably and effectively. We aim at establishing the provable reliability of construction and the feasibility of component-based solutions for the secure Web server.","PeriodicalId":344868,"journal":{"name":"IEEE 37th Annual 2003 International Carnahan Conference onSecurity Technology, 2003. Proceedings.","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116562863","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Recommendation of information sharing and analysis center 推荐信息共享和分析中心
Kwo-Jean Farna, Andrew Ren-Wei Fungb, Abe C. Lin
The announcement made by The Executive Yuan at September 10, 2002 about Chinese hacker invasion and implanting the Trojan program and collecting information from November 2001 to July 2002 disclosed once more the fact that our national information security mechanism is still insufficient. Based on this fact, we firstly take a simple insight of the present situation of hacker invasion and communication monitoring system, and discuss the penetration testing instructions made by Premier Yu, and then, referring to the implementation by western countries of building up "Information Sharing and Analysis Centers" (ISAC) to deal with information security threats such as the "Chinese hacker invasion" event, we will expound the issue. Moreover, we are also studying the necessary steps of the planning and implementation of the defensive mechanism for Information and Communication security, which is crucial to our National Information and Communicative Initiative (NICI).
行政院于2002年9月10日公布的2001年11月至2002年7月中国黑客入侵并植入木马程序并收集信息的公告,再次暴露了我国国家信息安全机制仍然不足的事实。基于此,我们首先对黑客入侵和通信监控系统的现状进行了简单的了解,并讨论了俞总理的渗透测试指示,然后参考西方国家建立“信息共享与分析中心”(ISAC)以应对“中国黑客入侵”事件等信息安全威胁的实施情况,对问题进行阐述。此外,我们还在研究规划和实施信息和通信安全防御机制的必要步骤,这对我们的国家信息和通信倡议(NICI)至关重要。
{"title":"Recommendation of information sharing and analysis center","authors":"Kwo-Jean Farna, Andrew Ren-Wei Fungb, Abe C. Lin","doi":"10.1109/CCST.2003.1297590","DOIUrl":"https://doi.org/10.1109/CCST.2003.1297590","url":null,"abstract":"The announcement made by The Executive Yuan at September 10, 2002 about Chinese hacker invasion and implanting the Trojan program and collecting information from November 2001 to July 2002 disclosed once more the fact that our national information security mechanism is still insufficient. Based on this fact, we firstly take a simple insight of the present situation of hacker invasion and communication monitoring system, and discuss the penetration testing instructions made by Premier Yu, and then, referring to the implementation by western countries of building up \"Information Sharing and Analysis Centers\" (ISAC) to deal with information security threats such as the \"Chinese hacker invasion\" event, we will expound the issue. Moreover, we are also studying the necessary steps of the planning and implementation of the defensive mechanism for Information and Communication security, which is crucial to our National Information and Communicative Initiative (NICI).","PeriodicalId":344868,"journal":{"name":"IEEE 37th Annual 2003 International Carnahan Conference onSecurity Technology, 2003. Proceedings.","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121531573","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Contingency planning: emergency preparedness for terrorist attacks 应急计划:针对恐怖袭击的应急准备
H.-M. Wang
The terrorist attack is one type of emergency caused by humans. This emergency is rare, but can cause catastrophic effects. In the aftermath of 9-11, it is proprietary security personnel's responsibility to help every employee get back to "business as normal" while at the same time, being prepared for possible terrorist attacks. An up-to-date contingency plan is expected to help security managers to fulfill this role. Security managers should reassess or develop the contingency plan by using the Federal Emergency Management Agency's (FEMA) guidebook. They are encouraged to adopt the Homeland Security Advisory System, or alternatively to develop a simple color-coded system, to response the threats of terrorist attack in stages. They are suggested to consider three factors-top executive's commitment, adequate trainings, and coordination with public agencies-in the planning.
恐怖袭击是人类造成的一种紧急情况。这种紧急情况很少见,但会造成灾难性的影响。在9-11之后,公司的保安人员有责任帮助每位员工恢复“正常工作”,同时为可能发生的恐怖袭击做好准备。最新的应急计划有望帮助安全管理人员履行这一职责。安全管理人员应根据联邦紧急事务管理局(FEMA)的指南重新评估或制定应急计划。他们被鼓励采用国土安全咨询系统,或者开发一个简单的颜色编码系统,以分阶段应对恐怖袭击的威胁。建议他们在规划时考虑三个因素:高层管理人员的承诺、充分的培训和与公共机构的协调。
{"title":"Contingency planning: emergency preparedness for terrorist attacks","authors":"H.-M. Wang","doi":"10.1109/CCST.2003.1297616","DOIUrl":"https://doi.org/10.1109/CCST.2003.1297616","url":null,"abstract":"The terrorist attack is one type of emergency caused by humans. This emergency is rare, but can cause catastrophic effects. In the aftermath of 9-11, it is proprietary security personnel's responsibility to help every employee get back to \"business as normal\" while at the same time, being prepared for possible terrorist attacks. An up-to-date contingency plan is expected to help security managers to fulfill this role. Security managers should reassess or develop the contingency plan by using the Federal Emergency Management Agency's (FEMA) guidebook. They are encouraged to adopt the Homeland Security Advisory System, or alternatively to develop a simple color-coded system, to response the threats of terrorist attack in stages. They are suggested to consider three factors-top executive's commitment, adequate trainings, and coordination with public agencies-in the planning.","PeriodicalId":344868,"journal":{"name":"IEEE 37th Annual 2003 International Carnahan Conference onSecurity Technology, 2003. Proceedings.","volume":"62 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2003-10-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114229205","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
期刊
IEEE 37th Annual 2003 International Carnahan Conference onSecurity Technology, 2003. Proceedings.
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1