Biblio

Over the years, false news has polluted the online media landscape across the world. In this “post-truth” era, the narratives created by false news have now come into fruition through dismantled democracies, disbelief in science, and hyper-polarized societies. Despite increased efforts in fact-checking & labeling, strengthening detection systems, de-platforming powerful users, promoting media literacy and awareness of the issue, false news continues to be spread exponentially. This study models the behaviors of both the victims of false news and the platform in which it is spread— through the system dynamics methodology. The model was used to develop a policy design by evaluating existing and proposed solutions. The results recommended actively countering confirmation bias, restructuring social networking sites’ recommendation algorithms, and increasing public trust in news organizations.

In this paper, we tried to summarize the practical experience of information security audits of nuclear power plants' automated process control system (I&C). The article presents a methodology for auditing the information security of instrumentation and control systems for nuclear power plants. The methodology was developed taking into account international and national Russian norms and rules and standards. The audit taxonomy, classification lifecycle are described. The taxonomy of information security audits shows that form, objectives of the I&C information security audit, and procedures can vary widely. A conceptual program is considered and discussed in details. The distinctive feature of the methodology is the mandatory consideration of the impact of information security on nuclear safety.

The international Supply Chains (SC) have expanded rapidly over the decades and also consist of many entities and business partners. The increasing complexity of supply chain makes it more vulnerable to a security threat. Therefore, it is necessary to evaluate security management systems to ensure the flow of goods in SC. In this paper we used international standards to assess the security of the company's supply chain compliance with ISO 28001. Supply chain security that needs to be assessed includes all inbound logistics activities to outbound logistics. The aim of this research is to analyse the security management system by identifying security threat, consequences, and likelihood to develop adequate countermeasures for the security of the company's supply chain. Security risk assessment was done using methodology compliance with ISO 28001 which are identify scope of security assessment, conduct security assessment, list applicable threat scenario, determine consequences, determine likelihood, determine risk score, risk evaluation using risk matrix, determine counter measures, and estimation of risk matrix after countermeasures. This research conducted in one of the leather factory in Indonesia. In this research we divided security threat into five category: asset security, personnel security, information security, goods and conveyance security, and closed cargo transport units. The security assessment was conducted by considering the performance review according to ISO 28001: 2007 and the results show that there are 22 security threat scenarios in the company's supply chain. Based upon a system of priorities by risk score, countermeasures are designed to reduce the threat into acceptable level.

In this work an overview of basic approaches to choosing protective measures for automated process control systems is done. The aim of the research was to develop a method for choosing protection measures for information security at every APCs level using set theory within analysis of basic sets of protection measures. In the framework of the research relevant attacks on industrial infrastructure are considered, an algorithm of choosing APCs protective measures is constructed, and it is suggested that it is required to use protective measures for every system level in accordance with an individual assessment of data protection class at the corresponding level. The authors concluded that it is necessary to exclude from consideration “specification of an adapted basic set” of the algorithm for choosing APCs protection measures in case the adapted basic set of APCs protective measures provides blocking all security threats at the considered system level. The approach to choosing protection measures based on building Euler-Venn diagrams is suggested. The results of the research are recommended to be used when modeling information security threats and developing requirements for APCs information protection means.

In the theoretical part of the paper, the scope of application of pseudorandom numbers and methods of their generation, as well as methods of statistical testing of pseudorandom sequences (PS) are considered. In the practical part of the work, the quality of PS obtained by Mersenne Twister [1] generator and the cryptographic generator of the RNGCryptoServiceProvider class of the. NET platform is evaluated. Based on the conducted research, the results of testing are obtained, which show that the quality of pseudorandom sequences generated by the cryptographic random number generator is higher than PS generated by Mersenne Twister. Additionally, based on statistical analysis by NIST and TestU01, a study is conducted in an attempt to establish the statistical indistinguishability of sets of empty- and stegocontainers created using a two-dimensional associative masking mechanism [2-4] based on a gamma of at least 500 KB in length. Research work was carried out under the guidance of R.F. Gibadullin, Associate Professor of the Department of Computer Systems of Kazan National Research Technical University named after A.N.Tupolev-KAI.

This article describes the process assembling of Encryption & Decryption In Trusted Platform Module of encoding information in NM640X \textregistered. Encoding of information, carried out in assembly language according to Gost 28147-89. It is a realisation of standard GOST 28147-89- Russian state symmetric key block cipher. GOST 28147-89 has 64-bit to access the kernel, trust, and allocated memory in the BlockSize and 256-bit KeySize.

An exceptional feature of the development of modern operating systems based on the Linux kernel is their leading use in cloud technologies, mobile devices and the Internet of things, which is accompanied by the emergence of more and more security threats at the kernel level. In order to improve the security of existing and future Linux distributions, it is necessary to analyze the existing approaches and tools for automated vulnerability detection and to conduct experimental security testing of some current versions of the kernel. The research is based on fuzzing - a software testing technique, which consists in the automated detection of implementation errors by sending deliberately incorrect data to the input of the fuzzer and analyzing the program's response at its output. Using the Syzkaller software tool, which implements a code coverage approach, vulnerabilities of the Linux kernel level were identified in stable versions used in modern distributions. The direction of this research is relevant and requires further development in order to detect zero-day vulnerabilities in new versions of the kernel, which is an important and necessary link in increasing the security of the Linux operating system family.

The purpose of this work is to implement a universal system for collecting and analyzing event logs from sources that use the Windows operating system. The authors use event-forwarding technology to collect data from logs. Security information and event management detects incidents from received events. The authors analyze existing methods for transmitting event log entries from sources running the Windows operating system. This article describes in detail how to connect event sources running on the Windows operating system to the event collector without connecting to a domain controller. Event sources are authenticated using certificates created by the event collector. The authors suggest a scheme for connecting the event collector to security information and event management. Security information and event management must meet the requirements for use in conjunction with event forwarding technology. The authors of the article demonstrate the scheme of the test stand and the result of testing the event forwarding technology.

The paper dwells on the design of a diagnostic system and expert assessment of the significance of threats to the security of industrial networks. The proposed system is based on a new cyber-attacks classification and presupposes the existence of two structural blocks: the industrial network virtual model based on the scan selected nodal points and the generator of cyber-attacks sets. The diagnostic and expert assessment quality is improved by the use of the Markov chains or the Monte Carlo numerical method. The numerical algorithm of generating cyber-attacks sets is based on the LP$\tau$-sequence.

The problem of analytical synthesis of the reduced order state observer for the bilinear dynamic system with scalar input and vector output has been considered. Formulas for calculation of the matrix coefficients of the nonlinear observer with estimation error asymptotically approaching zero have been obtained. Two modifications of observer dynamic equation have been proposed: the first one requires differentiation of an output signal and the second one does not. Based on the matrix canonization technology, the solvability conditions for the synthesis problem and analytical expressions for an acceptable set of solutions have been received. A precise step-by-step algorithm for calculating the observer coefficients has been offered. An example of the practical use of the developed algorithm has been given.