Restricted Authentication and Encryption for Cyber-physical Systems

DOE Office of Scientific and Technical Information (OSTI.GOV)

Kirkpatrick, Michael S; Bertino, Elisa; Sheldon, Frederick T

2009-01-01

Cyber-physical systems (CPS) are characterized by the close linkage of computational resources and physical devices. These systems can be deployed in a number of critical infrastructure settings. As a result, the security requirements of CPS are different than traditional computing architectures. For example, critical functions must be identified and isolated from interference by other functions. Similarly, lightweight schemes may be required, as CPS can include devices with limited computing power. One approach that offers promise for CPS security is the use of lightweight, hardware-based authentication. Specifically, we consider the use of Physically Unclonable Functions (PUFs) to bind an access requestmore » to specific hardware with device-specific keys. PUFs are implemented in hardware, such as SRAM, and can be used to uniquely identify the device. This technology could be used in CPS to ensure location-based access control and encryption, both of which would be desirable for CPS implementations.« less

Applying New Network Security Technologies to SCADA Systems.

DOE Office of Scientific and Technical Information (OSTI.GOV)

Hurd, Steven A; Stamp, Jason Edwin; Duggan, David P

2006-11-01

Supervisory Control and Data Acquisition (SCADA) systems for automation are very important for critical infrastructure and manufacturing operations. They have been implemented to work in a number of physical environments using a variety of hardware, software, networking protocols, and communications technologies, often before security issues became of paramount concern. To offer solutions to security shortcomings in the short/medium term, this project was to identify technologies used to secure "traditional" IT networks and systems, and then assess their efficacy with respect to SCADA systems. These proposed solutions must be relatively simple to implement, reliable, and acceptable to SCADA owners and operators.more » 4This page intentionally left blank.« less

A Quantum Multi-proxy Blind Signature Scheme Based on Genuine Four-Qubit Entangled State

NASA Astrophysics Data System (ADS)

Tian, Juan-Hong; Zhang, Jian-Zhong; Li, Yan-Ping

2016-02-01

In this paper, we propose a multi-proxy blind signature scheme based on controlled teleportation. Genuine four-qubit entangled state functions as quantum channel. The scheme uses the physical characteristics of quantum mechanics to implement delegation, signature and verification. The security analysis shows the scheme satisfies the security features of multi-proxy signature, unforgeability, undeniability, blindness and unconditional security.

Aviation security : preliminary observations on TSA's progress and challenges in meeting the statutory mandate for screening air cargo on passenger aircraft.

DOT National Transportation Integrated Search

2009-03-01

The Implementing : Recommendations of the 9/11 : Commission Act of 2007 mandates : the Department of Homeland : Security (DHS) to establish a : system to physically screen 50 : percent of cargo transported on : passenger aircraft by February : 2009 a...

Privacy and security compliance in the E-healthcare marketplace.

PubMed

Lutes, M

2000-03-01

Complying with security and privacy regulations proposed by HHS in response to the Health Insurance Portability and Accountability Act (HIPAA) will require healthcare managers to address both internal and external business interactions and initiatives. The proposed regulations mandate certain procedures regarding administration, physical safeguards, technical security for data integrity and confidentiality, and technical security against unauthorized access. In particular, the proposed regulations require organizations to contractually ensure that vendors adhere to the regulations. Healthcare organizations also must implement training procedures for staff members who have contact with protected health information and designate a privacy officer to guard against improper disclosure of such information. Documented policies for organizational decision making are vital to an organization's efforts to implement procedures for compliance with the regulations.

Assessing security technology's impact: old tools for new problems.

PubMed

Kreissl, Reinhard

2014-09-01

The general idea developed in this paper from a sociological perspective is that some of the foundational categories on which the debate about privacy, security and technology rests are blurring. This process is a consequence of a blurring of physical and digital worlds. In order to define limits for legitimate use of intrusive digital technologies, one has to refer to binary distinctions such as private versus public, human versus technical, security versus insecurity to draw differences determining limits for the use of surveillance technologies. These distinctions developed in the physical world and are rooted in a cultural understanding of pre-digital culture. Attempts to capture the problems emerging with the implementation of security technologies using legal reasoning encounter a number of problems since law is by definition oriented backwards, adapting new developments to existing traditions, whereas the intrusion of new technologies in the physical world produces changes and creates fundamentally new problems.

Telerehabilitation store and forward applications: a review of applications and privacy considerations in physical and occupational therapy practice.

PubMed

Peterson, Christopher; Watzlaf, Valerie

2014-01-01

An overview of store and forward applications commonly used in physical and occupational therapy practice is reviewed with respect to regulation, privacy, security, and clinical applications. A privacy and security checklist provides a clear reference of pertinent regulatory issues regarding these software applications. A case study format is used to highlight clinical applications of store and forward software features. Important considerations of successful implementation of store and forward applications are also identified and discussed.

High-Assurance Spiral

DTIC Science & Technology

2017-11-01

Public Release; Distribution Unlimited. PA# 88ABW-2017-5388 Date Cleared: 30 OCT 2017 13. SUPPLEMENTARY NOTES 14. ABSTRACT Cyber- physical systems... physical processes that interact in intricate manners. This makes verification of the software complex and unwieldy. In this report, an approach towards...resulting implementations. 15. SUBJECT TERMS Cyber- physical systems, Formal guarantees, Code generation 16. SECURITY CLASSIFICATION OF: 17

An Improved Quantum Proxy Blind Signature Scheme Based on Genuine Seven-Qubit Entangled State

NASA Astrophysics Data System (ADS)

Yang, Yuan-Yuan; Xie, Shu-Cui; Zhang, Jian-Zhong

2017-07-01

An improved quantum proxy blind signature scheme based on controlled teleportation is proposed in this paper. Genuine seven-qubit entangled state functions as quantum channel. We use the physical characteristics of quantum mechanics to implement delegation, signature and verification. Security analysis shows that our scheme is unforgeability, undeniability, blind and unconditionally secure. Meanwhile, we propose a trust party to provide higher security, the trust party is costless.

Quantum key distribution with hacking countermeasures and long term field trial.

PubMed

Dixon, A R; Dynes, J F; Lucamarini, M; Fröhlich, B; Sharpe, A W; Plews, A; Tam, W; Yuan, Z L; Tanizawa, Y; Sato, H; Kawamura, S; Fujiwara, M; Sasaki, M; Shields, A J

2017-05-16

Quantum key distribution's (QKD's) central and unique claim is information theoretic security. However there is an increasing understanding that the security of a QKD system relies not only on theoretical security proofs, but also on how closely the physical system matches the theoretical models and prevents attacks due to discrepancies. These side channel or hacking attacks exploit physical devices which do not necessarily behave precisely as the theory expects. As such there is a need for QKD systems to be demonstrated to provide security both in the theoretical and physical implementation. We report here a QKD system designed with this goal in mind, providing a more resilient target against possible hacking attacks including Trojan horse, detector blinding, phase randomisation and photon number splitting attacks. The QKD system was installed into a 45 km link of a metropolitan telecom network for a 2.5 month period, during which time the system operated continuously and distributed 1.33 Tbits of secure key data with a stable secure key rate over 200 kbit/s. In addition security is demonstrated against coherent attacks that are more general than the collective class of attacks usually considered.

Biosafety practices associated with potential agents of biocrime and biowarfare.

PubMed

Burnett, LouAnn C

2006-12-01

Conducting research in a manner that guards against theft and intentional misuse of biological materials requires a process of hazard identification and risk assessment to most effectively identify and implement a risk management plan. Procedures describing physical security, personnel reliability, and material control and accountability define a security plan for this type of research.

High speed and adaptable error correction for megabit/s rate quantum key distribution.

PubMed

Dixon, A R; Sato, H

2014-12-02

Quantum Key Distribution is moving from its theoretical foundation of unconditional security to rapidly approaching real world installations. A significant part of this move is the orders of magnitude increases in the rate at which secure key bits are distributed. However, these advances have mostly been confined to the physical hardware stage of QKD, with software post-processing often being unable to support the high raw bit rates. In a complete implementation this leads to a bottleneck limiting the final secure key rate of the system unnecessarily. Here we report details of equally high rate error correction which is further adaptable to maximise the secure key rate under a range of different operating conditions. The error correction is implemented both in CPU and GPU using a bi-directional LDPC approach and can provide 90-94% of the ideal secure key rate over all fibre distances from 0-80 km.

High speed and adaptable error correction for megabit/s rate quantum key distribution

PubMed Central

Dixon, A. R.; Sato, H.

2014-01-01

Quantum Key Distribution is moving from its theoretical foundation of unconditional security to rapidly approaching real world installations. A significant part of this move is the orders of magnitude increases in the rate at which secure key bits are distributed. However, these advances have mostly been confined to the physical hardware stage of QKD, with software post-processing often being unable to support the high raw bit rates. In a complete implementation this leads to a bottleneck limiting the final secure key rate of the system unnecessarily. Here we report details of equally high rate error correction which is further adaptable to maximise the secure key rate under a range of different operating conditions. The error correction is implemented both in CPU and GPU using a bi-directional LDPC approach and can provide 90–94% of the ideal secure key rate over all fibre distances from 0–80 km. PMID:25450416

Computer Network Security- The Challenges of Securing a Computer Network

NASA Technical Reports Server (NTRS)

Scotti, Vincent, Jr.

2011-01-01

This article is intended to give the reader an overall perspective on what it takes to design, implement, enforce and secure a computer network in the federal and corporate world to insure the confidentiality, integrity and availability of information. While we will be giving you an overview of network design and security, this article will concentrate on the technology and human factors of securing a network and the challenges faced by those doing so. It will cover the large number of policies and the limits of technology and physical efforts to enforce such policies.

A framework to enhance security of physically unclonable functions using chaotic circuits

NASA Astrophysics Data System (ADS)

Chen, Lanxiang

2018-05-01

As a new technique for authentication and key generation, physically unclonable function (PUF) has attracted considerable attentions, with extensive research results achieved already. To resist the popular machine learning modeling attacks, a framework to enhance the security of PUFs is proposed. The basic idea is to combine PUFs with a chaotic system of which the response is highly sensitive to initial conditions. For this framework, a specific construction which combines the common arbiter PUF circuit, a converter, and the Chua's circuit is given to implement a more secure PUF. Simulation experiments are presented to further validate the framework. Finally, some practical suggestions for the framework and specific construction are also discussed.

Research on information security system of waste terminal disposal process

NASA Astrophysics Data System (ADS)

Zhou, Chao; Wang, Ziying; Guo, Jing; Guo, Yajuan; Huang, Wei

2017-05-01

Informatization has penetrated the whole process of production and operation of electric power enterprises. It not only improves the level of lean management and quality service, but also faces severe security risks. The internal network terminal is the outermost layer and the most vulnerable node of the inner network boundary. It has the characteristics of wide distribution, long depth and large quantity. The user and operation and maintenance personnel technical level and security awareness is uneven, which led to the internal network terminal is the weakest link in information security. Through the implementation of security of management, technology and physics, we should establish an internal network terminal security protection system, so as to fully protect the internal network terminal information security.

Noise properties in the ideal Kirchhoff-Law-Johnson-Noise secure communication system.

PubMed

Gingl, Zoltan; Mingesz, Robert

2014-01-01

In this paper we determine the noise properties needed for unconditional security for the ideal Kirchhoff-Law-Johnson-Noise (KLJN) secure key distribution system using simple statistical analysis. It has already been shown using physical laws that resistors and Johnson-like noise sources provide unconditional security. However real implementations use artificial noise generators, therefore it is a question if other kind of noise sources and resistor values could be used as well. We answer this question and in the same time we provide a theoretical basis to analyze real systems as well.

Resonant Inductive Power Transfer for Noncontact Launcher-Missile Interface

DTIC Science & Technology

2016-08-01

implementation of a wireless power transfer system based on the concept of non-radiating inductive coupling. 14. SUBJECT TERMS Resonant Inductive Coupling... Wireless Power Transfer 15. NUMBER OF PAGES 18 16. PRICE CODE 17. SECURITY CLASSIFICATION OF REPORT UNCLASSIFIED 18. SECURITY...2 In contrast to the ideal transformer, wireless inductive power transfer assumes that the coils are no longer physically connected by an iron core

The role of the health physicist in nuclear security.

PubMed

Waller, Edward J; van Maanen, Jim

2015-04-01

Health physics is a recognized safety function in the holistic context of the protection of workers, members of the public, and the environment against the hazardous effects of ionizing radiation, often generically designated as radiation protection. The role of the health physicist as protector dates back to the Manhattan Project. Nuclear security is the prevention and detection of, and response to, criminal or intentional unauthorized acts involving or directed at nuclear material, other radioactive material, associated facilities, or associated activities. Its importance has become more visible and pronounced in the post 9/11 environment, and it has a shared purpose with health physics in the context of protection of workers, members of the public, and the environment. However, the duties and responsibilities of the health physicist in the nuclear security domain are neither clearly defined nor recognized, while a fundamental understanding of nuclear phenomena in general, nuclear or other radioactive material specifically, and the potential hazards related to them is required for threat assessment, protection, and risk management. Furthermore, given the unique skills and attributes of professional health physicists, it is argued that the role of the health physicist should encompass all aspects of nuclear security, ranging from input in the development to implementation and execution of an efficient and effective nuclear security regime. As such, health physicists should transcend their current typical role as consultants in nuclear security issues and become fully integrated and recognized experts in the nuclear security domain and decision making process. Issues regarding the security clearances of health physics personnel and the possibility of insider threats must be addressed in the same manner as for other trusted individuals; however, the net gain from recognizing and integrating health physics expertise in all levels of a nuclear security regime far outweighs any negative aspects. In fact, it can be argued that health physics is essential in achieving an integrated approach toward nuclear safety, security, and safeguards.

The Role of the Health Physicist in Nuclear Security

PubMed Central

Waller, Edward J.; van Maanen, Jim

2015-01-01

Abstract Health physics is a recognized safety function in the holistic context of the protection of workers, members of the public, and the environment against the hazardous effects of ionizing radiation, often generically designated as radiation protection. The role of the health physicist as protector dates back to the Manhattan Project. Nuclear security is the prevention and detection of, and response to, criminal or intentional unauthorized acts involving or directed at nuclear material, other radioactive material, associated facilities, or associated activities. Its importance has become more visible and pronounced in the post 9/11 environment, and it has a shared purpose with health physics in the context of protection of workers, members of the public, and the environment. However, the duties and responsibilities of the health physicist in the nuclear security domain are neither clearly defined nor recognized, while a fundamental understanding of nuclear phenomena in general, nuclear or other radioactive material specifically, and the potential hazards related to them is required for threat assessment, protection, and risk management. Furthermore, given the unique skills and attributes of professional health physicists, it is argued that the role of the health physicist should encompass all aspects of nuclear security, ranging from input in the development to implementation and execution of an efficient and effective nuclear security regime. As such, health physicists should transcend their current typical role as consultants in nuclear security issues and become fully integrated and recognized experts in the nuclear security domain and decision making process. Issues regarding the security clearances of health physics personnel and the possibility of insider threats must be addressed in the same manner as for other trusted individuals; however, the net gain from recognizing and integrating health physics expertise in all levels of a nuclear security regime far outweighs any negative aspects. In fact, it can be argued that health physics is essential in achieving an integrated approach toward nuclear safety, security, and safeguards. PMID:25706142

Three tenets for secure cyber-physical system design and assessment

NASA Astrophysics Data System (ADS)

Hughes, Jeff; Cybenko, George

2014-06-01

This paper presents a threat-driven quantitative mathematical framework for secure cyber-physical system design and assessment. Called The Three Tenets, this originally empirical approach has been used by the US Air Force Research Laboratory (AFRL) for secure system research and development. The Tenets were first documented in 2005 as a teachable methodology. The Tenets are motivated by a system threat model that itself consists of three elements which must exist for successful attacks to occur: - system susceptibility; - threat accessibility and; - threat capability. The Three Tenets arise naturally by countering each threat element individually. Specifically, the tenets are: Tenet 1: Focus on What's Critical - systems should include only essential functions (to reduce susceptibility); Tenet 2: Move Key Assets Out-of-Band - make mission essential elements and security controls difficult for attackers to reach logically and physically (to reduce accessibility); Tenet 3: Detect, React, Adapt - confound the attacker by implementing sensing system elements with dynamic response technologies (to counteract the attackers' capabilities). As a design methodology, the Tenets mitigate reverse engineering and subsequent attacks on complex systems. Quantified by a Bayesian analysis and further justified by analytic properties of attack graph models, the Tenets suggest concrete cyber security metrics for system assessment.

International Nuclear Security

DOE Office of Scientific and Technical Information (OSTI.GOV)

Doyle, James E.

2012-08-14

This presentation discusses: (1) Definitions of international nuclear security; (2) What degree of security do we have now; (3) Limitations of a nuclear security strategy focused on national lock-downs of fissile materials and weapons; (4) What do current trends say about the future; and (5) How can nuclear security be strengthened? Nuclear security can be strengthened by: (1) More accurate baseline inventories; (2) Better physical protection, control and accounting; (3) Effective personnel reliability programs; (4) Minimize weapons-usable materials and consolidate to fewer locations; (5) Consider local threat environment when siting facilities; (6) Implement pledges made in the NSS process; andmore » (7) More robust interdiction, emergency response and special operations capabilities. International cooperation is desirable, but not always possible.« less

Physically secured orthogonal frequency division multiplexing-passive optical network employing noise-based encryption and signal recovery process

NASA Astrophysics Data System (ADS)

Jin, Wei; Zhang, Chongfu; Yuan, Weicheng

2016-02-01

We propose a physically enhanced secure scheme for direct detection-orthogonal frequency division multiplexing-passive optical network (DD-OFDM-PON) and long reach coherent detection-orthogonal frequency division multiplexing-passive optical network (LRCO-OFDM-PON), by employing noise-based encryption and channel/phase estimation. The noise data generated by chaos mapping are used to substitute training sequences in preamble to realize channel estimation and frame synchronization, and also to be embedded on variable number of key-selected randomly spaced pilot subcarriers to implement phase estimation. Consequently, the information used for signal recovery is totally hidden as unpredictable noise information in OFDM frames to mask useful information and to prevent illegal users from correctly realizing OFDM demodulation, and thereby enhancing resistance to attackers. The levels of illegal-decryption complexity and implementation complexity are theoretically discussed. Through extensive simulations, the performances of the proposed channel/phase estimation and the security introduced by encrypted pilot carriers have been investigated in both DD-OFDM and LRCO-OFDM systems. In addition, in the proposed secure DD-OFDM/LRCO-OFDM PON models, both legal and illegal receiving scenarios have been considered. These results show that, by utilizing the proposed scheme, the resistance to attackers can be significantly enhanced in DD-OFDM-PON and LRCO-OFDM-PON systems without performance degradations.

Radiological Threat Reduction (RTR) program : implementing physical security to protect large radioactive sources worldwide.

DOE Office of Scientific and Technical Information (OSTI.GOV)

Lowe, Daniel L.

2004-11-01

The U.S. Department of Energy's Radiological Threat Reduction (RTR) Program strives to reduce the threat of a Radiological Dispersion Device (RDD) incident that could affect U.S. interests worldwide. Sandia National Laboratories supports the RTR program on many different levels. Sandia works directly with DOE to develop strategies, including the selection of countries to receive support and the identification of radioactive materials to be protected. Sandia also works with DOE in the development of guidelines and in training DOE project managers in physical protection principles. Other support to DOE includes performing rapid assessments and providing guidance for establishing foreign regulatory andmore » knowledge infrastructure. Sandia works directly with foreign governments to establish cooperative agreements necessary to implement the RTR Program efforts to protect radioactive sources. Once necessary agreements are in place, Sandia works with in-country organizations to implement various security related initiatives, such as installing security systems and searching for (and securing) orphaned radioactive sources. The radioactive materials of interest to the RTR program include Cobalt 60, Cesium 137, Strontium 90, Iridium 192, Radium 226, Plutonium 238, Americium 241, Californium 252, and Others. Security systems are implemented using a standardized approach that provides consistency through out the RTR program efforts at Sandia. The approach incorporates a series of major tasks that overlap in order to provide continuity. The major task sequence is to: Establish in-country contacts - integrators, Obtain material characterizations, Perform site assessments and vulnerability assessments, Develop upgrade plans, Procure and install equipment, Conduct acceptance testing and performance testing, Develop procedures, and Conduct training. Other tasks are incorporated as appropriate and commonly include such as support of reconfiguring infrastructure, and developing security plans, etc. This standardized approach is applied to specific country and regional needs. Recent examples (FY 2003-2004) include foreign missions to Lithuania, Russian Federation Navy, Russia - PNPI, Greece (joint mission with IAEA), Tanzania, Iraq, Chile, Ecuador, and Egypt. Some of the ambitions and results of the RTR program may be characterized by the successes in Lithuania, Greece, and Russia.« less

Detection and response to unauthorized access to a communication device

DOEpatents

Smith, Rhett; Gordon, Colin

2015-09-08

A communication gateway consistent with the present disclosure may detect unauthorized physical or electronic access and implement security actions in response thereto. A communication gateway may provide a communication path to an intelligent electronic device (IED) using an IED communications port configured to communicate with the IED. The communication gateway may include a physical intrusion detection port and a network port. The communication gateway may further include control logic configured to evaluate physical intrusion detection signal. The control logic may be configured to determine that the physical intrusion detection signal is indicative of an attempt to obtain unauthorized access to one of the communication gateway, the IED, and a device in communication with the gateway; and take a security action based upon the determination that the indication is indicative of the attempt to gain unauthorized access.

DOE Office of Scientific and Technical Information (OSTI.GOV)

Physical device safety is typically implemented locally using embedded controllers, while operations safety is primarily performed in control centers. Safe operations can be enhanced by correct design of device-level control algorithms, and protocols, procedures and operator training at the control-room level, but all can fail. Moreover, these elements exchange data and issue commands via vulnerable communication layers. In order to secure these gaps and enhance operational safety, we believe monitoring of command sequences must be combined with an awareness of physical device limitations and automata models that capture safety mechanisms. One way of doing this is by leveraging specification-based intrusionmore » detection to monitor for physical constraint violations. The method can also verify that physical infrastructure state is consistent with monitoring information and control commands exchanged between field devices and control centers. This additional security layer enhances protection from both outsider attacks and insider mistakes. We implemented specification-based SCADA command analyzers using physical constraint algorithms directly in the Bro framework and Broccoli APIs for three separate scenarios: a water heater, an automated distribution system, and an over-current protection scheme. To accomplish this, we added low-level analyzers capable of examining control system-specific protocol packets for both Modbus TCP and DNP3, and also higher-level analyzers able to interpret device command and data streams within the context of each device's physical capabilities and present operational state. Thus the software that we are making available includes the Bro/Broccoli scripts for these three scenarios, as well as simulators, written in C, of those scenarios that generate sample traffic that is monitored by the Bro/Broccoli scripts. In addition, we have also implemented systems to directly pull cyber-physical information from the OSIsoft PI historian system. We have included the Python scripts used to perform that monitoring.« less

Attacks on practical quantum key distribution systems (and how to prevent them)

NASA Astrophysics Data System (ADS)

Jain, Nitin; Stiller, Birgit; Khan, Imran; Elser, Dominique; Marquardt, Christoph; Leuchs, Gerd

2016-07-01

With the emergence of an information society, the idea of protecting sensitive data is steadily gaining importance. Conventional encryption methods may not be sufficient to guarantee data protection in the future. Quantum key distribution (QKD) is an emerging technology that exploits fundamental physical properties to guarantee perfect security in theory. However, it is not easy to ensure in practice that the implementations of QKD systems are exactly in line with the theoretical specifications. Such theory-practice deviations can open loopholes and compromise security. Several such loopholes have been discovered and investigated in the last decade. These activities have motivated the proposal and implementation of appropriate countermeasures, thereby preventing future attacks and enhancing the practical security of QKD. This article introduces the so-called field of quantum hacking by summarising a variety of attacks and their prevention mechanisms.

The Development and Implementation of Career Information and Guidance Systems to Enhance Recruitment and Retention of ROTC Cadets for Army Careers

DTIC Science & Technology

1990-07-01

relations, variety, working conditions, cultural identity, physical prowess, and economic security. The measures of reliability were computed for the VS: 1...Prowess, Ability Utilization, and Physical Activity and the lowest scale scores on Cultural Identity, Social Relations, and Prestige. Those with neutral...and Cultural Identity and the lowest scale scores on Physical Prowess, Advancement, and Risk. Table 14 Highest and Lowest Rated Value Scale Dimensions

Safeguards and Security by Design (SSBD) for Small Modular Reactors (SMRs) through a Common Global Approach

DOE Office of Scientific and Technical Information (OSTI.GOV)

Badwan, Faris M.; Demuth, Scott Francis; Miller, Michael Conrad

Small Modular Reactors (SMR) with power levels significantly less than the currently standard 1000 to 1600-MWe reactors have been proposed as a potential game changer for future nuclear power. SMRs may offer a simpler, more standardized, and safer modular design by using factory built and easily transportable components. Additionally, SMRs may be more easily built and operated in isolated locations, and may require smaller initial capital investment and shorter construction times. Because many SMRs designs are still conceptual and consequently not yet fixed, designers have a unique opportunity to incorporate updated design basis threats, emergency preparedness requirements, and then fullymore » integrate safety, physical security, and safeguards/material control and accounting (MC&A) designs. Integrating safety, physical security, and safeguards is often referred to as integrating the 3Ss, and early consideration of safeguards and security in the design is often referred to as safeguards and security by design (SSBD). This paper describes U.S./Russian collaborative efforts toward developing an internationally accepted common approach for implementing SSBD/3Ss for SMRs based upon domestic requirements, and international guidance and requirements. These collaborative efforts originated with the Nuclear Energy and Nuclear Security working group established under the U.S.-Russia Bilateral Presidential Commission during the 2009 Presidential Summit. Initial efforts have focused on review of U.S. and Russian domestic requirements for Security and MC&A, IAEA guidance for security and MC&A, and IAEA requirements for international safeguards. Additionally, example SMR design features that can enhance proliferation resistance and physical security have been collected from past work and reported here. The development of a U.S./Russian common approach for SSBD/3Ss should aid the designer of SMRs located anywhere in the world. More specifically, the application of this approach may lead to more proliferation resistant and physically secure design features for SMRs.« less

Holographic radar imaging privacy techniques utilizing dual-frequency implementation

NASA Astrophysics Data System (ADS)

McMakin, Douglas L.; Hall, Thomas E.; Sheen, David M.

2008-04-01

Over the last 15 years, the Pacific Northwest National Laboratory has performed significant research and development activities to enhance the state of the art of holographic radar imaging systems to be used at security checkpoints for screening people for concealed threats hidden under their garments. These enhancement activities included improvements to privacy techniques to remove human features and providing automatic detection of body-worn concealed threats. The enhanced privacy and detection methods used both physical and software imaging techniques. The physical imaging techniques included polarization-diversity illumination and reception, dual-frequency implementation, and high-frequency imaging at 60 GHz. Software imaging techniques to enhance the privacy of the person under surveillance included extracting concealed threat artifacts from the imagery to automatically detect the threat. This paper will focus on physical privacy techniques using dual-frequency implementation.

Holographic Radar Imaging Privacy Techniques Utilizing Dual-Frequency Implementation

DOE Office of Scientific and Technical Information (OSTI.GOV)

McMakin, Douglas L.; Hall, Thomas E.; Sheen, David M.

2008-04-18

Over the last 15 years, the Pacific Northwest National Laboratory has performed significant research and development activities to enhance the state of the art of holographic radar imaging systems to be used at security checkpoints for screening people for concealed threats hidden under their garments. These enhancement activities included improvements to privacy techniques to remove human features and providing automatic detection of body-worn concealed threats. The enhanced privacy and detection methods used both physical and software imaging techniques. The physical imaging techniques included polarization-diversity illumination and reception, dual-frequency implementation, and high-frequency imaging at 60 GHz. Software imaging techniques to enhancemore » the privacy of the person under surveillance included extracting concealed threat artifacts from the imagery to automatically detect the threat. This paper will focus on physical privacy techniques using dual-frequency implementation.« less

QCAPUF: QCA-based physically unclonable function as a hardware security primitive

NASA Astrophysics Data System (ADS)

Abutaleb, M. M.

2018-04-01

Physically unclonable functions (PUFs) are increasingly used as innovative security primitives to provide the hardware authentication and identification as well as the secret key generation based on unique and random variations in identically fabricated devices. Security and low power have appeared to become two crucial necessities to modern designs. As an emerging nanoelectronic technology, a quantum-dot cellular automata (QCA) can achieve ultra-low power consumption as well as an extremely small area for implementing digital designs. However, there are various classes of permanent defects that can happen during the manufacture of QCA devices. The recent extensive research has been focused on how to eliminate errors in QCA structures resulting from fabrication variances. By a completely different vision, to turn this disadvantage into an advantage, this paper presents a novel QCA-based PUF (QCAPUF) architecture to exploit the unique physical characteristics of fabricated QCA cells in order to produce different hardware fingerprint instances. This architecture is composed of proposed logic and interconnect blocks that have critical vulnerabilities and perform unexpected logical operations. The behaviour of QCAPUF is thoroughly analysed through physical relations and simulations. Results confirm that the proposed QCAPUF has state of the art PUF characteristics in the QCA technology. This paper will serve as a basis for further research into QCA-based hardware security primitives and applications.

A Quantum Proxy Signature Scheme Based on Genuine Five-qubit Entangled State

NASA Astrophysics Data System (ADS)

Cao, Hai-Jing; Huang, Jun; Yu, Yao-Feng; Jiang, Xiu-Li

2014-09-01

In this paper a very efficient and secure proxy signature scheme is proposed. It is based on controlled quantum teleportation. Genuine five-qubit entangled state functions as quantum channel. The scheme uses the physical characteristics of quantum mechanics to implement delegation, signature and verification. Quantum key distribution and one-time pad are adopted in our scheme, which could guarantee not only the unconditional security of the scheme but also the anonymity of the messages owner.

Health Information Security in Hospitals: the Application of Security Safeguards.

PubMed

Mehraeen, Esmaeil; Ayatollahi, Haleh; Ahmadi, Maryam

2016-02-01

A hospital information system has potentials to improve the accessibility of clinical information and the quality of health care. However, the use of this system has resulted in new challenges, such as concerns over health information security. This paper aims to assess the status of information security in terms of administrative, technical and physical safeguards in the university hospitals. This was a survey study in which the participants were information technology (IT) managers (n=36) who worked in the hospitals affiliated to the top ranked medical universities (university A and university B). Data were collected using a questionnaire. The content validity of the questionnaire was examined by the experts and the reliability of the questionnaire was determined using Cronbach's coefficient alpha (α=0.75). The results showed that the administrative safeguards were arranged at a medium level. In terms of the technical safeguards and the physical safeguards, the IT managers rated them at a strong level. According to the results, among three types of security safeguards, the administrative safeguards were assessed at the medium level. To improve it, developing security policies, implementing access control models and training users are recommended.

Practical private database queries based on a quantum-key-distribution protocol

DOE Office of Scientific and Technical Information (OSTI.GOV)

Jakobi, Markus; Humboldt-Universitaet zu Berlin, D-10117 Berlin; Simon, Christoph

2011-02-15

Private queries allow a user, Alice, to learn an element of a database held by a provider, Bob, without revealing which element she is interested in, while limiting her information about the other elements. We propose to implement private queries based on a quantum-key-distribution protocol, with changes only in the classical postprocessing of the key. This approach makes our scheme both easy to implement and loss tolerant. While unconditionally secure private queries are known to be impossible, we argue that an interesting degree of security can be achieved by relying on fundamental physical principles instead of unverifiable security assumptions inmore » order to protect both the user and the database. We think that the scope exists for such practical private queries to become another remarkable application of quantum information in the footsteps of quantum key distribution.« less

Secure self-calibrating quantum random-bit generator

DOE Office of Scientific and Technical Information (OSTI.GOV)

Fiorentino, M.; Santori, C.; Spillane, S. M.

2007-03-15

Random-bit generators (RBGs) are key components of a variety of information processing applications ranging from simulations to cryptography. In particular, cryptographic systems require 'strong' RBGs that produce high-entropy bit sequences, but traditional software pseudo-RBGs have very low entropy content and therefore are relatively weak for cryptography. Hardware RBGs yield entropy from chaotic or quantum physical systems and therefore are expected to exhibit high entropy, but in current implementations their exact entropy content is unknown. Here we report a quantum random-bit generator (QRBG) that harvests entropy by measuring single-photon and entangled two-photon polarization states. We introduce and implement a quantum tomographicmore » method to measure a lower bound on the 'min-entropy' of the system, and we employ this value to distill a truly random-bit sequence. This approach is secure: even if an attacker takes control of the source of optical states, a secure random sequence can be distilled.« less

Computation and Communication Evaluation of an Authentication Mechanism for Time-Triggered Networked Control Systems

PubMed Central

Martins, Goncalo; Moondra, Arul; Dubey, Abhishek; Bhattacharjee, Anirban; Koutsoukos, Xenofon D.

2016-01-01

In modern networked control applications, confidentiality and integrity are important features to address in order to prevent against attacks. Moreover, network control systems are a fundamental part of the communication components of current cyber-physical systems (e.g., automotive communications). Many networked control systems employ Time-Triggered (TT) architectures that provide mechanisms enabling the exchange of precise and synchronous messages. TT systems have computation and communication constraints, and with the aim to enable secure communications in the network, it is important to evaluate the computational and communication overhead of implementing secure communication mechanisms. This paper presents a comprehensive analysis and evaluation of the effects of adding a Hash-based Message Authentication (HMAC) to TT networked control systems. The contributions of the paper include (1) the analysis and experimental validation of the communication overhead, as well as a scalability analysis that utilizes the experimental result for both wired and wireless platforms and (2) an experimental evaluation of the computational overhead of HMAC based on a kernel-level Linux implementation. An automotive application is used as an example, and the results show that it is feasible to implement a secure communication mechanism without interfering with the existing automotive controller execution times. The methods and results of the paper can be used for evaluating the performance impact of security mechanisms and, thus, for the design of secure wired and wireless TT networked control systems. PMID:27463718

Computation and Communication Evaluation of an Authentication Mechanism for Time-Triggered Networked Control Systems.

PubMed

Martins, Goncalo; Moondra, Arul; Dubey, Abhishek; Bhattacharjee, Anirban; Koutsoukos, Xenofon D

2016-07-25

In modern networked control applications, confidentiality and integrity are important features to address in order to prevent against attacks. Moreover, network control systems are a fundamental part of the communication components of current cyber-physical systems (e.g., automotive communications). Many networked control systems employ Time-Triggered (TT) architectures that provide mechanisms enabling the exchange of precise and synchronous messages. TT systems have computation and communication constraints, and with the aim to enable secure communications in the network, it is important to evaluate the computational and communication overhead of implementing secure communication mechanisms. This paper presents a comprehensive analysis and evaluation of the effects of adding a Hash-based Message Authentication (HMAC) to TT networked control systems. The contributions of the paper include (1) the analysis and experimental validation of the communication overhead, as well as a scalability analysis that utilizes the experimental result for both wired and wireless platforms and (2) an experimental evaluation of the computational overhead of HMAC based on a kernel-level Linux implementation. An automotive application is used as an example, and the results show that it is feasible to implement a secure communication mechanism without interfering with the existing automotive controller execution times. The methods and results of the paper can be used for evaluating the performance impact of security mechanisms and, thus, for the design of secure wired and wireless TT networked control systems.

A Quantum Proxy Weak Blind Signature Scheme Based on Controlled Quantum Teleportation

NASA Astrophysics Data System (ADS)

Cao, Hai-Jing; Yu, Yao-Feng; Song, Qin; Gao, Lan-Xiang

2015-04-01

Proxy blind signature is applied to the electronic paying system, electronic voting system, mobile agent system, security of internet, etc. A quantum proxy weak blind signature scheme is proposed in this paper. It is based on controlled quantum teleportation. Five-qubit entangled state functions as quantum channel. The scheme uses the physical characteristics of quantum mechanics to implement message blinding, so it could guarantee not only the unconditional security of the scheme but also the anonymity of the messages owner.

Tight finite-key analysis for quantum cryptography

PubMed Central

Tomamichel, Marco; Lim, Charles Ci Wen; Gisin, Nicolas; Renner, Renato

2012-01-01

Despite enormous theoretical and experimental progress in quantum cryptography, the security of most current implementations of quantum key distribution is still not rigorously established. One significant problem is that the security of the final key strongly depends on the number, M, of signals exchanged between the legitimate parties. Yet, existing security proofs are often only valid asymptotically, for unrealistically large values of M. Another challenge is that most security proofs are very sensitive to small differences between the physical devices used by the protocol and the theoretical model used to describe them. Here we show that these gaps between theory and experiment can be simultaneously overcome by using a recently developed proof technique based on the uncertainty relation for smooth entropies. PMID:22252558

Tight finite-key analysis for quantum cryptography.

PubMed

Tomamichel, Marco; Lim, Charles Ci Wen; Gisin, Nicolas; Renner, Renato

2012-01-17

Despite enormous theoretical and experimental progress in quantum cryptography, the security of most current implementations of quantum key distribution is still not rigorously established. One significant problem is that the security of the final key strongly depends on the number, M, of signals exchanged between the legitimate parties. Yet, existing security proofs are often only valid asymptotically, for unrealistically large values of M. Another challenge is that most security proofs are very sensitive to small differences between the physical devices used by the protocol and the theoretical model used to describe them. Here we show that these gaps between theory and experiment can be simultaneously overcome by using a recently developed proof technique based on the uncertainty relation for smooth entropies.

44 CFR 6.85 - Reproduction fees.

Code of Federal Regulations, 2010 CFR

2010-10-01

... 44 Emergency Management and Assistance 1 2010-10-01 2010-10-01 false Reproduction fees. 6.85... HOMELAND SECURITY GENERAL IMPLEMENTATION OF THE PRIVACY ACT OF 1974 Fees § 6.85 Reproduction fees. (a... over 81/2 x 14 inches or whose physical characteristics do not permit reproduction by routine...

44 CFR 6.85 - Reproduction fees.

Code of Federal Regulations, 2011 CFR

2011-10-01

... 44 Emergency Management and Assistance 1 2011-10-01 2011-10-01 false Reproduction fees. 6.85... HOMELAND SECURITY GENERAL IMPLEMENTATION OF THE PRIVACY ACT OF 1974 Fees § 6.85 Reproduction fees. (a... over 81/2 x 14 inches or whose physical characteristics do not permit reproduction by routine...

Exploitation of Unintentional Information Leakage from Integrated Circuits

ERIC Educational Resources Information Center

Cobb, William E.

2011-01-01

The information leakage of electronic devices, especially those used in cryptographic or other vital applications, represents a serious practical threat to secure systems. While physical implementation attacks have evolved rapidly over the last decade, relatively little work has been done to allow system designers to effectively counter the…

44 CFR 63.5 - Coverage for contents removal.

Code of Federal Regulations, 2013 CFR

2013-10-01

... OF HOMELAND SECURITY INSURANCE AND HAZARD MITIGATION National Flood Insurance Program IMPLEMENTATION OF SECTION 1306(c) OF THE NATIONAL FLOOD INSURANCE ACT OF 1968 General § 63.5 Coverage for contents... the definition of “Direct Physical Loss by or from Flood” in the SFIP for the expense of removing...

44 CFR 63.5 - Coverage for contents removal.

Code of Federal Regulations, 2012 CFR

2012-10-01

... OF HOMELAND SECURITY INSURANCE AND HAZARD MITIGATION National Flood Insurance Program IMPLEMENTATION OF SECTION 1306(c) OF THE NATIONAL FLOOD INSURANCE ACT OF 1968 General § 63.5 Coverage for contents... the definition of “Direct Physical Loss by or from Flood” in the SFIP for the expense of removing...

Dual-surface dielectric depth detector for holographic millimeter-wave security scanners

NASA Astrophysics Data System (ADS)

McMakin, Douglas L.; Keller, Paul E.; Sheen, David M.; Hall, Thomas E.

2009-05-01

The Transportation Security Administration (TSA) is presently deploying millimeter-wave whole body scanners at over 20 airports in the United States. Threats that may be concealed on a person are displayed to the security operator of this scanner. "Passenger privacy is ensured through the anonymity of the image. The officer attending the passenger cannot view the image, and the officer viewing the image is remotely located and cannot see the passenger. Additionally, the image cannot be stored, transmitted or printed and is deleted immediately after being viewed. Finally, the facial area of the image has been blurred to further ensure privacy." Pacific Northwest National Laboratory (PNNL) originated research into this novel security technology which has been independently commercialized by L-3 Communications, SafeView, Inc. PNNL continues to perform fundamental research into improved software techniques which are applicable to the field of holographic security screening technology. This includes performing significant research to remove human features from the imagery. Both physical and software imaging techniques have been employed. The physical imaging techniques include polarization diversity illumination and reception, dual frequency implementation, and high frequency imaging at 100 GHz. This paper will focus on a software privacy technique using a dual surface dielectric depth detector method.

A quantum proxy group signature scheme based on an entangled five-qubit state

NASA Astrophysics Data System (ADS)

Wang, Meiling; Ma, Wenping; Wang, Lili; Yin, Xunru

2015-09-01

A quantum proxy group signature (QPGS) scheme based on controlled teleportation is presented, by using the entangled five-qubit quantum state functions as quantum channel. The scheme uses the physical characteristics of quantum mechanics to implement delegation, signature and verification. The security of the scheme is guaranteed by the entanglement correlations of the entangled five-qubit state, the secret keys based on the quantum key distribution (QKD) and the one-time pad algorithm, all of which have been proven to be unconditionally secure and the signature anonymity.

A Novel Quantum Solution to Privacy-Preserving Nearest Neighbor Query in Location-Based Services

NASA Astrophysics Data System (ADS)

Luo, Zhen-yu; Shi, Run-hua; Xu, Min; Zhang, Shun

2018-04-01

We present a cheating-sensitive quantum protocol for Privacy-Preserving Nearest Neighbor Query based on Oblivious Quantum Key Distribution and Quantum Encryption. Compared with the classical related protocols, our proposed protocol has higher security, because the security of our protocol is based on basic physical principles of quantum mechanics, instead of difficulty assumptions. Especially, our protocol takes single photons as quantum resources and only needs to perform single-photon projective measurement. Therefore, it is feasible to implement this protocol with the present technologies.

Long-distance continuous-variable quantum key distribution by controlling excess noise

NASA Astrophysics Data System (ADS)

Huang, Duan; Huang, Peng; Lin, Dakai; Zeng, Guihua

2016-01-01

Quantum cryptography founded on the laws of physics could revolutionize the way in which communication information is protected. Significant progresses in long-distance quantum key distribution based on discrete variables have led to the secure quantum communication in real-world conditions being available. However, the alternative approach implemented with continuous variables has not yet reached the secure distance beyond 100 km. Here, we overcome the previous range limitation by controlling system excess noise and report such a long distance continuous-variable quantum key distribution experiment. Our result paves the road to the large-scale secure quantum communication with continuous variables and serves as a stepping stone in the quest for quantum network.

Long-distance continuous-variable quantum key distribution by controlling excess noise.

PubMed

Huang, Duan; Huang, Peng; Lin, Dakai; Zeng, Guihua

2016-01-13

Quantum cryptography founded on the laws of physics could revolutionize the way in which communication information is protected. Significant progresses in long-distance quantum key distribution based on discrete variables have led to the secure quantum communication in real-world conditions being available. However, the alternative approach implemented with continuous variables has not yet reached the secure distance beyond 100 km. Here, we overcome the previous range limitation by controlling system excess noise and report such a long distance continuous-variable quantum key distribution experiment. Our result paves the road to the large-scale secure quantum communication with continuous variables and serves as a stepping stone in the quest for quantum network.

Long-distance continuous-variable quantum key distribution by controlling excess noise

PubMed Central

Huang, Duan; Huang, Peng; Lin, Dakai; Zeng, Guihua

2016-01-01

Quantum cryptography founded on the laws of physics could revolutionize the way in which communication information is protected. Significant progresses in long-distance quantum key distribution based on discrete variables have led to the secure quantum communication in real-world conditions being available. However, the alternative approach implemented with continuous variables has not yet reached the secure distance beyond 100 km. Here, we overcome the previous range limitation by controlling system excess noise and report such a long distance continuous-variable quantum key distribution experiment. Our result paves the road to the large-scale secure quantum communication with continuous variables and serves as a stepping stone in the quest for quantum network. PMID:26758727

Cooperative global security programs modeling & simulation.

DOE Office of Scientific and Technical Information (OSTI.GOV)

Briand, Daniel

2010-05-01

The national laboratories global security programs implement sustainable technical solutions for cooperative nonproliferation, arms control, and physical security systems worldwide. To help in the development and execution of these programs, a wide range of analytical tools are used to model, for example, synthetic tactical environments for assessing infrastructure protection initiatives and tactics, systematic approaches for prioritizing nuclear and biological threat reduction opportunities worldwide, and nuclear fuel cycle enrichment and spent fuel management for nuclear power countries. This presentation will describe how these models are used in analyses to support the Obama Administration's agenda and bilateral/multinational treaties, and ultimately, to reducemore » weapons of mass destruction and terrorism threats through international technical cooperation.« less

Practical quantum digital signature

NASA Astrophysics Data System (ADS)

Yin, Hua-Lei; Fu, Yao; Chen, Zeng-Bing

2016-03-01

Guaranteeing nonrepudiation, unforgeability as well as transferability of a signature is one of the most vital safeguards in today's e-commerce era. Based on fundamental laws of quantum physics, quantum digital signature (QDS) aims to provide information-theoretic security for this cryptographic task. However, up to date, the previously proposed QDS protocols are impractical due to various challenging problems and most importantly, the requirement of authenticated (secure) quantum channels between participants. Here, we present the first quantum digital signature protocol that removes the assumption of authenticated quantum channels while remaining secure against the collective attacks. Besides, our QDS protocol can be practically implemented over more than 100 km under current mature technology as used in quantum key distribution.

Pakistans Nuclear Weapons

DTIC Science & Technology

2016-02-12

not be subject to International Atomic Energy Agency ( IAEA ) safeguards have the potential to produce 280...PNRA states that Pakistan follows IAEA physical protection standards. Proliferation A fundamental aspect of nuclear security is ensuring that...related to the design and fabrication of a nuclear explosive device,” according to the IAEA (Implementation of the NPT Safeguards Agreement in the

Measurement-Device-Independent Quantum Cryptography

NASA Astrophysics Data System (ADS)

Tang, Zhiyuan

Quantum key distribution (QKD) enables two legitimate parties to share a secret key even in the presence of an eavesdropper. The unconditional security of QKD is based on the fundamental laws of quantum physics. Original security proofs of QKD are based on a few assumptions, e.g., perfect single photon sources and perfect single-photon detectors. However, practical implementations of QKD systems do not fully comply with such assumptions due to technical limitations. The gap between theory and implementations leads to security loopholes in most QKD systems, and several attacks have been launched on sophisticated QKD systems. Particularly, the detectors have been found to be the most vulnerable part of QKD. Much effort has been put to build side-channel-free QKD systems. Solutions such as security patches and device-independent QKD have been proposed. However, the former are normally ad-hoc, and cannot close unidentified loopholes. The latter, while having the advantages of removing all assumptions on devices, is impractical to implement today. Measurement-device-independent QKD (MDI-QKD) turns out to be a promising solution to the security problem of QKD. In MDI-QKD, all security loopholes, including those yet-to-be discovered, have been removed from the detectors, the most critical part in QKD. In this thesis, we investigate issues related to the practical implementation and security of MDI-QKD. We first present a demonstration of polarization-encoding MDI-QKD. Taking finite key effect into account, we achieve a secret key rate of 0.005 bit per second (bps) over 10 km spooled telecom fiber, and a 1600-bit key is distributed. This work, together with other demonstrations, shows the practicality of MDI-QKD. Next we investigate a critical assumption of MDI-QKD: perfect state preparation. We apply the loss-tolerant QKD protocol and adapt it to MDI-QKD to quantify information leakage due to imperfect state preparation. We then present an experimental demonstration of MDI-QKD over 10 km and 40 km of spooled fiber, which for the first time considers the impact of inaccurate polarization state preparation on the secret key rate. This would not have been possible under previous security proofs, given the same amount of state preparation flaws.

Security Analysis of Smart Grid Cyber Physical Infrastructures Using Modeling and Game Theoretic Simulation

DOE Office of Scientific and Technical Information (OSTI.GOV)

Abercrombie, Robert K; Sheldon, Frederick T.

Cyber physical computing infrastructures typically consist of a number of sites are interconnected. Its operation critically depends both on cyber components and physical components. Both types of components are subject to attacks of different kinds and frequencies, which must be accounted for the initial provisioning and subsequent operation of the infrastructure via information security analysis. Information security analysis can be performed using game theory implemented in dynamic Agent Based Game Theoretic (ABGT) simulations. Such simulations can be verified with the results from game theory analysis and further used to explore larger scale, real world scenarios involving multiple attackers, defenders, andmore » information assets. We concentrated our analysis on the electric sector failure scenarios and impact analyses by the NESCOR Working Group Study, From the Section 5 electric sector representative failure scenarios; we extracted the four generic failure scenarios and grouped them into three specific threat categories (confidentiality, integrity, and availability) to the system. These specific failure scenarios serve as a demonstration of our simulation. The analysis using our ABGT simulation demonstrates how to model the electric sector functional domain using a set of rationalized game theoretic rules decomposed from the failure scenarios in terms of how those scenarios might impact the cyber physical infrastructure network with respect to CIA.« less

Discrimination, Internalized Homonegativity, and Attitudes Toward Children of Same-Sex Parents: Can Secure Attachment Buffer Against Stigma Internalization?

PubMed

Trub, Leora; Quinlan, Ella; Starks, Tyrel J; Rosenthal, Lisa

2017-09-01

With increasing numbers of same-sex couples raising children in the United States, discriminatory attitudes toward children of same-sex parents (ACSSP) are of increasing concern. As with other forms of stigma and discrimination, lesbian, gay, and bisexual (LGB) individuals are at risk for internalizing these societal attitudes, which can negatively affect parenting-related decisions and behaviors and the mental and physical health of their children. Secure attachment is characterized by positive views of the self as loveable and worthy of care that are understood to develop in early relationships with caregivers. Secure attachment has been associated with positive mental and physical health, including among LGB individuals and couples. This study aimed to test the potential buffering role of secure attachment against stigma internalization by examining associations among secure attachment, discrimination, internalized homonegativity (IH), and ACSSP in an online survey study of 209 U.S. adults in same-sex relationships. Bootstrap analyses supported our hypothesized moderated mediation model, with secure attachment being a buffer. Greater discrimination was indirectly associated with more negative ACSSP through greater IH for individuals with mean or lower levels, but not for individuals with higher than average levels of secure attachment, specifically because among those with higher levels of secure attachment, discrimination was not associated with IH. These findings build on and extend past research, with important implications for future research and clinical work with LGB individuals, same-sex couples, and their families, including potential implementation of interventions targeting attachment security. © 2016 Family Process Institute.

76 FR 78009 - Information Collection; Implementation of Information Technology Security Provision

Federal Register 2010, 2011, 2012, 2013, 2014

2011-12-15

...] Information Collection; Implementation of Information Technology Security Provision AGENCY: General Services... collection requirement regarding Implementation of Information Technology Security Provision. Public comments... Information Collection 3090- 0294, Implementation of Information Technology Security Provision, by any of the...

DOE Office of Scientific and Technical Information (OSTI.GOV)

Mahan, Robert E.; Fluckiger, Jerry D.; Clements, Samuel L.

This document was developed to provide guidance for the implementation of secure data transfer in a complex computational infrastructure representative of the electric power and oil and natural gas enterprises and the control systems they implement. For the past 20 years the cyber security community has focused on preventative measures intended to keep systems secure by providing a hard outer shell that is difficult to penetrate. Over time, the hard exterior, soft interior focus changed to focus on defense-in-depth adding multiple layers of protection, introducing intrusion detection systems, more effective incident response and cleanup, and many other security measures. Despitemore » much larger expenditures and more layers of defense, successful attacks have only increased in number and severity. Consequently, it is time to re-focus the conventional approach to cyber security. While it is still important to implement measures to keep intruders out, a new protection paradigm is warranted that is aimed at discovering attempted or real compromises as early as possible. Put simply, organizations should take as fact that they have been, are now, or will be compromised. These compromises may be intended to steal information for financial gain as in the theft of intellectual property or credentials that lead to the theft of financial resources, or to lie silent until instructed to cause physical or electronic damage and/or denial of services. This change in outlook has been recently confirmed by the National Security Agency [19]. The discovery of attempted and actual compromises requires an increased focus on monitoring events by manual and/or automated log monitoring, detecting unauthorized changes to a system's hardware and/or software, detecting intrusions, and/or discovering the exfiltration of sensitive information and/or attempts to send inappropriate commands to ICS/SCADA (Industrial Control System/Supervisory Control And Data Acquisition) systems.« less

Securing health sensing using integrated circuit metric.

PubMed

Tahir, Ruhma; Tahir, Hasan; McDonald-Maier, Klaus

2015-10-20

Convergence of technologies from several domains of computing and healthcare have aided in the creation of devices that can help health professionals in monitoring their patients remotely. An increase in networked healthcare devices has resulted in incidents related to data theft, medical identity theft and insurance fraud. In this paper, we discuss the design and implementation of a secure lightweight wearable health sensing system. The proposed system is based on an emerging security technology called Integrated Circuit Metric (ICMetric) that extracts the inherent features of a device to generate a unique device identification. In this paper, we provide details of how the physical characteristics of a health sensor can be used for the generation of hardware "fingerprints". The obtained fingerprints are used to deliver security services like authentication, confidentiality, secure admission and symmetric key generation. The generated symmetric key is used to securely communicate the health records and data of the patient. Based on experimental results and the security analysis of the proposed scheme, it is apparent that the proposed system enables high levels of security for health monitoring in resource optimized manner.

Securing Health Sensing Using Integrated Circuit Metric

PubMed Central

Tahir, Ruhma; Tahir, Hasan; McDonald-Maier, Klaus

2015-01-01

Convergence of technologies from several domains of computing and healthcare have aided in the creation of devices that can help health professionals in monitoring their patients remotely. An increase in networked healthcare devices has resulted in incidents related to data theft, medical identity theft and insurance fraud. In this paper, we discuss the design and implementation of a secure lightweight wearable health sensing system. The proposed system is based on an emerging security technology called Integrated Circuit Metric (ICMetric) that extracts the inherent features of a device to generate a unique device identification. In this paper, we provide details of how the physical characteristics of a health sensor can be used for the generation of hardware “fingerprints”. The obtained fingerprints are used to deliver security services like authentication, confidentiality, secure admission and symmetric key generation. The generated symmetric key is used to securely communicate the health records and data of the patient. Based on experimental results and the security analysis of the proposed scheme, it is apparent that the proposed system enables high levels of security for health monitoring in resource optimized manner. PMID:26492250

Autonomous execution of the Precision Immobilization Technique

NASA Astrophysics Data System (ADS)

Mascareñas, David D. L.; Stull, Christopher J.; Farrar, Charles R.

2017-03-01

Over the course of the last decade great advances have been made in autonomously driving cars. The technology has advanced to the point that driverless car technology is currently being tested on publicly accessed roadways. The introduction of these technologies onto publicly accessed roadways not only raises questions of safety, but also security. Autonomously driving cars are inherently cyber-physical systems and as such will have novel security vulnerabilities that couple both the cyber aspects of the vehicle including the on-board computing and any network data it makes use of, with the physical nature of the vehicle including its sensors, actuators, and the vehicle chassis. Widespread implementation of driverless car technology will require that both the cyber, as well as physical security concerns surrounding these vehicles are addressed. In this work, we specifically developed a control policy to autonomously execute the Precision Immobilization Technique, a.k.a. the PIT maneuver. The PIT maneuver was originally developed by law enforcement to end high-speed vehicular pursuits in a quasi-safe manner. However, there is still a risk of damage/roll-over to both the vehicle executing the PIT maneuver as well as to the vehicle subject to the PIT maneuver. In law enforcement applications, it would be preferable to execute the PIT maneuver using an autonomous vehicle, thus removing the danger to law-enforcement officers. Furthermore, it is entirely possible that unscrupulous individuals could inject code into an autonomously-driving car to use the PIT maneuver to immobilize other vehicles while maintaining anonymity. For these reasons it is useful to know how the PIT maneuver can be implemented on an autonomous car. In this work a simple control policy based on velocity pursuit was developed to autonomously execute the PIT maneuver using only a vision and range measurements that are both commonly collected by contemporary driverless cars. The ability of this control policy to execute the PIT maneuver was demonstrated both in simulation and experimentally. The results of this work can help inform the design of autonomous car with regards to ensuring their cyber-physical security.

The Impact of Visibility on Teamwork, Collaborative Communication, and Security in Emergency Departments: An Exploratory Study.

PubMed

Gharaveis, Arsalan; Hamilton, D Kirk; Pati, Debajyoti; Shepley, Mardelle

2017-01-01

The aim of this study was to examine the influence of visibility on teamwork, collaborative communication, and security issues in emergency departments (EDs). This research explored whether with high visibility in EDs, teamwork and collaborative communication can be improved while the security issues will be reduced. Visibility has been regarded as a critical design consideration and can be directly and considerably impacted by ED's physical design. Teamwork is one of the major related operational outcomes of visibility and involves nurses, support staff, and physicians. The collaborative communication in an ED is another important factor in the process of care delivery and affects efficiency and safety. Furthermore, security is a behavioral factor in ED designs, which includes all types of safety including staff safety, patient safety, and the safety of visitors and family members. This qualitative study investigated the impact of visibility on teamwork, collaborative communication, and security issues in the ED. One-on-one interviews and on-site observation sessions were conducted in a community hospital. Corresponding data analysis was implemented by using computer plan analysis, observation and interview content, and theme analyses. The findings of this exploratory study provided a framework to identify visibility as an influential factor in ED design. High levels of visibility impact productivity and efficiency of teamwork and communication and improve the chance of lowering security issues. The findings of this study also contribute to the general body of knowledge about the effect of physical design on teamwork, collaborative communication, and security.

Secure and Resilient Functional Modeling for Navy Cyber-Physical Systems

DTIC Science & Technology

2017-05-24

Functional Modeling Compiler (SCCT) FM Compiler and Key Performance Indicators (KPI) May 2018 Pending. Model Management Backbone (SCCT) MMB Demonstration...implement the agent- based distributed runtime. - KPIs for single/multicore controllers and temporal/spatial domains. - Integration of the model management ...Distributed Runtime (UCI) Not started. Model Management Backbone (SCCT) Not started. Siemens Corporation Corporate Technology Unrestricted

A Quantum Multi-Proxy Weak Blind Signature Scheme Based on Entanglement Swapping

NASA Astrophysics Data System (ADS)

Yan, LiLi; Chang, Yan; Zhang, ShiBin; Han, GuiHua; Sheng, ZhiWei

2017-02-01

In this paper, we present a multi-proxy weak blind signature scheme based on quantum entanglement swapping of Bell states. In the scheme, proxy signers can finish the signature instead of original singer with his/her authority. It can be applied to the electronic voting system, electronic paying system, etc. The scheme uses the physical characteristics of quantum mechanics to implement delegation, signature and verification. It could guarantee not only the unconditionally security but also the anonymity of the message owner. The security analysis shows the scheme satisfies the security features of multi-proxy weak signature, singers cannot disavowal his/her signature while the signature cannot be forged by others, and the message owner can be traced.

Quantum Privacy Amplification and the Security of Quantum Cryptography over Noisy Channels

DOE Office of Scientific and Technical Information (OSTI.GOV)

Deutsch, D.; Ekert, A.; Jozsa, R.

1996-09-01

Existing quantum cryptographic schemes are not, as they stand, operable in the presence of noise on the quantum communication channel. Although they become operable if they are supplemented by classical privacy-amplification techniques, the resulting schemes are difficult to analyze and have not been proved secure. We introduce the concept of quantum privacy amplification and a cryptographic scheme incorporating it which is provably secure over a noisy channel. The scheme uses an {open_quote}{open_quote}entanglement purification{close_quote}{close_quote} procedure which, because it requires only a few quantum controlled-not and single-qubit operations, could be implemented using technology that is currently being developed. {copyright} {ital 1996 Themore » American Physical Society.}« less

Ethics in Public Health Research

PubMed Central

Myers, Julie; Frieden, Thomas R.; Bherwani, Kamal M.; Henning, Kelly J.

2008-01-01

Public health agencies increasingly use electronic means to acquire, use, maintain, and store personal health information. Electronic data formats can improve performance of core public health functions, but potentially threaten privacy because they can be easily duplicated and transmitted to unauthorized people. Although such security breaches do occur, electronic data can be better secured than paper records, because authentication, authorization, auditing, and accountability can be facilitated. Public health professionals should collaborate with law and information technology colleagues to assess possible threats, implement updated policies, train staff, and develop preventive engineering measures to protect information. Tightened physical and electronic controls can prevent misuse of data, minimize the risk of security breaches, and help maintain the reputation and integrity of public health agencies. PMID:18382010

SPCC- Software Elements for Security Partition Communication Controller

NASA Astrophysics Data System (ADS)

Herpel, H. J.; Willig, G.; Montano, G.; Tverdyshev, S.; Eckstein, K.; Schoen, M.

2016-08-01

Future satellite missions like Earth Observation, Telecommunication or any other kind are likely to be exposed to various threats aiming at exploiting vulnerabilities of the involved systems and communications. Moreover, the growing complexity of systems coupled with more ambitious types of operational scenarios imply increased security vulnerabilities in the future. In the paper we will describe an architecture and software elements to ensure high level of security on-board a spacecraft. First the threats to the Security Partition Communication Controller (SPCC) will be addressed including the identification of specific vulnerabilities to the SPCC. Furthermore, appropriate security objectives and security requirements are identified to be counter the identified threats. The security evaluation of the SPCC will be done in accordance to the Common Criteria (CC). The Software Elements for SPCC has been implemented on flight representative hardware which consists of two major elements: the I/O board and the SPCC board. The SPCC board provides the interfaces with ground while the I/O board interfaces with typical spacecraft equipment busses. Both boards are physically interconnected by a high speed spacewire (SpW) link.

Safety and Security of Radioactive Sealed and Disused/Orphan Sources in Ukraine - German Contribution - 13359

DOE Office of Scientific and Technical Information (OSTI.GOV)

Brasser, Thomas; Hertes, Uwe; Meyer, Thorsten

2013-07-01

Within the scope of 'Nuclear Security of Radioactive Sources', the German government implemented the modernization of Ukrainian State Production Company's transport and storage facility for radioactive sources (TSF) in Kiev. The overall management of optimizing the physical protection of the storage facility (including the construction of a hot cell for handling the radioactive sources) is currently carried out by the German Federal Foreign Office (AA). AA jointly have assigned Gesellschaft fuer Anlagen- und Reaktorsicherheit (GRS) mbH, Germany's leading expert institution in the area of nuclear safety and waste management, to implement the project and to ensure transparency by financial andmore » technical monitoring. Sealed radioactive sources are widely used in industry, medicine and research. Their life cycle starts with the production and finally ends with the interim/long-term storage of the disused sources. In Ukraine, IZOTOP is responsible for all radioactive sources throughout their life cycle. IZOTOP's transport and storage facility (TSF) is the only Ukrainian storage facility for factory-fresh radioactive sources up to an activity of about 1 million Ci (3.7 1016 Bq). The TSF is specially designed for the storage and handling of radioactive sources. Storage began in 1968, and is licensed by the Ukrainian state authorities. Beside the outdated state of TSF's physical protection and the vulnerability of the facility linked with it, the lack of a hot cell for handling and repacking radioactive sources on the site itself represents an additional potential hazard. The project, financed by the German Federal Foreign Office, aims to significantly improve the security of radioactive sources during their storage and handling at the TSF site. Main tasks of the project are a) the modernization of the physical protection of the TSF itself in order to prevent any unauthorized access to radioactive sources as well as b) the construction of a hot cell to reduce the number of transports of radioactive sources within the city of Kiev. In future, the new established hot cell at IZOTOP's transport and storage facility will be useful for identification and characterization of orphan/disused radioactive sources. The projects implemented are performed in accordance with international recommendations (e. g. IAEA) and national normative documents and will make a crucial contribution towards an improved safety and security management of radioactive sources in Ukraine. (authors)« less

Examining Cybersecurity of Cyberphysical Systems for Critical Infrastructures Through Work Domain Analysis.

PubMed

Wang, Hao; Lau, Nathan; Gerdes, Ryan M

2018-04-01

The aim of this study was to apply work domain analysis for cybersecurity assessment and design of supervisory control and data acquisition (SCADA) systems. Adoption of information and communication technology in cyberphysical systems (CPSs) for critical infrastructures enables automated and distributed control but introduces cybersecurity risk. Many CPSs employ SCADA industrial control systems that have become the target of cyberattacks, which inflict physical damage without use of force. Given that absolute security is not feasible for complex systems, cyberintrusions that introduce unanticipated events will occur; a proper response will in turn require human adaptive ability. Therefore, analysis techniques that can support security assessment and human factors engineering are invaluable for defending CPSs. We conducted work domain analysis using the abstraction hierarchy (AH) to model a generic SCADA implementation to identify the functional structures and means-ends relations. We then adopted a case study approach examining the Stuxnet cyberattack by developing and integrating AHs for the uranium enrichment process, SCADA implementation, and malware to investigate the interactions between the three aspects of cybersecurity in CPSs. The AHs for modeling a generic SCADA implementation and studying the Stuxnet cyberattack are useful for mapping attack vectors, identifying deficiencies in security processes and features, and evaluating proposed security solutions with respect to system objectives. Work domain analysis is an effective analytical method for studying cybersecurity of CPSs for critical infrastructures in a psychologically relevant manner. Work domain analysis should be applied to assess cybersecurity risk and inform engineering and user interface design.

Emulation Platform for Cyber Analysis of Wireless Communication Network Protocols

DOE Office of Scientific and Technical Information (OSTI.GOV)

Van Leeuwen, Brian P.; Eldridge, John M.

Wireless networking and mobile communications is increasing around the world and in all sectors of our lives. With increasing use, the density and complexity of the systems increase with more base stations and advanced protocols to enable higher data throughputs. The security of data transported over wireless networks must also evolve with the advances in technologies enabling more capable wireless networks. However, means for analysis of the effectiveness of security approaches and implementations used on wireless networks are lacking. More specifically a capability to analyze the lower-layer protocols (i.e., Link and Physical layers) is a major challenge. An analysis approachmore » that incorporates protocol implementations without the need for RF emissions is necessary. In this research paper several emulation tools and custom extensions that enable an analysis platform to perform cyber security analysis of lower layer wireless networks is presented. A use case of a published exploit in the 802.11 (i.e., WiFi) protocol family is provided to demonstrate the effectiveness of the described emulation platform.« less

[The comparative evaluation of level of security culture in medical organizations].

PubMed

Roitberg, G E; Kondratova, N V; Galanina, E V

2016-01-01

The study was carried out on the basis of clinic “Medicine” in 2014-2015 concerning security culture. The sampling included 465 filled HSPSC questionnaires. The comparative analysis of received was implemented. The “Zubovskaia district hospital” Having no accreditation according security standards and group of clinics from USA functioning for many years in the system of patient security support were selected as objects for comparison. The evaluation was implemented concerning dynamics of security culture in organization at implementation of strategies of security of patients during 5 years and comparison of obtained results with USA clinics was made. The study results demonstrated that in conditions of absence of implemented standards of security in medical organization total evaluation of security remains extremely low. The study of security culture using HSPSC questionnaire is an effective tool for evaluating implementation of various strategies of security ofpatient. The functioning in the system of international standards of quality, primarily JCI standards, permits during several years to achieve high indices of security culture.

DoD Cybersecurity Discipline Implementation Plan

DTIC Science & Technology

2016-02-01

provided email services are disabled for commercial mobile devices. N/A Commanders and Supervisors must ensure all servers and network infrastructure ... infrastructure physically and logically. All of these protections come from security measures that are already required. This line of effort supports...networks and critical infrastructure . These threats and risks have been recognized by DoD for several years, and the Department has responded with

The Infrastructure Necessary to Support a Sustainable Material Protection, Control and Accounting (MPC&A) Program in Russia

DOE Office of Scientific and Technical Information (OSTI.GOV)

Bachner, Katherine M.; Mladineo, Stephen V.

The NNSA Material Protection, Control, and Accounting (MPC&A) program has been engaged for fifteen years in upgrading the security of nuclear materials in Russia. Part of the effort has been to establish the conditions necessary to ensure the long-term sustainability of nuclear security. A sustainable program of nuclear security requires the creation of an indigenous infrastructure, starting with sustained high level government commitment. This includes organizational development, training, maintenance, regulations, inspections, and a strong nuclear security culture. The provision of modern physical protection, control, and accounting equipment to the Russian Federation alone is not sufficient. Comprehensive infrastructure projects support themore » Russian Federation's ability to maintain the risk reduction achieved through upgrades to the equipment. To illustrate the contributions to security, and challenges of implementation, this paper discusses the history and next steps for an indigenous Tamper Indication Device (TID) program, and a Radiation Portal Monitoring (RPM) program.« less

6 CFR 37.43 - Physical security of DMV production facilities.

Code of Federal Regulations, 2012 CFR

2012-01-01

... 6 Domestic Security 1 2012-01-01 2012-01-01 false Physical security of DMV production facilities... Identification Card Production Facilities § 37.43 Physical security of DMV production facilities. (a) States must ensure the physical security of facilities where driver's licenses and identification cards are produced...

Designing Security-Hardened Microkernels For Field Devices

NASA Astrophysics Data System (ADS)

Hieb, Jeffrey; Graham, James

Distributed control systems (DCSs) play an essential role in the operation of critical infrastructures. Perimeter field devices are important DCS components that measure physical process parameters and perform control actions. Modern field devices are vulnerable to cyber attacks due to their increased adoption of commodity technologies and that fact that control networks are no longer isolated. This paper describes an approach for creating security-hardened field devices using operating system microkernels that isolate vital field device operations from untrusted network-accessible applications. The approach, which is influenced by the MILS and Nizza architectures, is implemented in a prototype field device. Whereas, previous microkernel-based implementations have been plagued by poor inter-process communication (IPC) performance, the prototype exhibits an average IPC overhead for protected device calls of 64.59 μs. The overall performance of field devices is influenced by several factors; nevertheless, the observed IPC overhead is low enough to encourage the continued development of the prototype.

A New Cloud Architecture of Virtual Trusted Platform Modules

NASA Astrophysics Data System (ADS)

Liu, Dongxi; Lee, Jack; Jang, Julian; Nepal, Surya; Zic, John

We propose and implement a cloud architecture of virtual Trusted Platform Modules (TPMs) to improve the usability of TPMs. In this architecture, virtual TPMs can be obtained from the TPM cloud on demand. Hence, the TPM functionality is available for applications that do not have physical TPMs in their local platforms. Moreover, the TPM cloud allows users to access their keys and data in the same virtual TPM even if they move to untrusted platforms. The TPM cloud is easy to access for applications in different languages since cloud computing delivers services in standard protocols. The functionality of the TPM cloud is demonstrated by applying it to implement the Needham-Schroeder public-key protocol for web authentications, such that the strong security provided by TPMs is integrated into high level applications. The chain of trust based on the TPM cloud is discussed and the security properties of the virtual TPMs in the cloud is analyzed.

10 CFR 110.44 - Physical security standards.

Code of Federal Regulations, 2014 CFR

2014-01-01

... 10 Energy 2 2014-01-01 2014-01-01 false Physical security standards. 110.44 Section 110.44 Energy... License Applications § 110.44 Physical security standards. (a) Physical security measures in recipient... publication INFCIRC/225/Rev. 4 (corrected), June 1999, “The Physical Protection of Nuclear Material and...

10 CFR 110.44 - Physical security standards.

Code of Federal Regulations, 2013 CFR

2013-01-01

... 10 Energy 2 2013-01-01 2013-01-01 false Physical security standards. 110.44 Section 110.44 Energy... License Applications § 110.44 Physical security standards. (a) Physical security measures in recipient... publication INFCIRC/225/Rev. 4 (corrected), June 1999, “The Physical Protection of Nuclear Material and...

10 CFR 110.44 - Physical security standards.

Code of Federal Regulations, 2012 CFR

2012-01-01

... 10 Energy 2 2012-01-01 2012-01-01 false Physical security standards. 110.44 Section 110.44 Energy... License Applications § 110.44 Physical security standards. (a) Physical security measures in recipient... publication INFCIRC/225/Rev. 4 (corrected), June 1999, “The Physical Protection of Nuclear Material and...

10 CFR 110.44 - Physical security standards.

Code of Federal Regulations, 2011 CFR

2011-01-01

... 10 Energy 2 2011-01-01 2011-01-01 false Physical security standards. 110.44 Section 110.44 Energy... License Applications § 110.44 Physical security standards. (a) Physical security measures in recipient... publication INFCIRC/225/Rev. 4 (corrected), June 1999, “The Physical Protection of Nuclear Material and...

Measurement-device-independent quantum digital signatures

NASA Astrophysics Data System (ADS)

Puthoor, Ittoop Vergheese; Amiri, Ryan; Wallden, Petros; Curty, Marcos; Andersson, Erika

2016-08-01

Digital signatures play an important role in software distribution, modern communication, and financial transactions, where it is important to detect forgery and tampering. Signatures are a cryptographic technique for validating the authenticity and integrity of messages, software, or digital documents. The security of currently used classical schemes relies on computational assumptions. Quantum digital signatures (QDS), on the other hand, provide information-theoretic security based on the laws of quantum physics. Recent work on QDS Amiri et al., Phys. Rev. A 93, 032325 (2016);, 10.1103/PhysRevA.93.032325 Yin, Fu, and Zeng-Bing, Phys. Rev. A 93, 032316 (2016), 10.1103/PhysRevA.93.032316 shows that such schemes do not require trusted quantum channels and are unconditionally secure against general coherent attacks. However, in practical QDS, just as in quantum key distribution (QKD), the detectors can be subjected to side-channel attacks, which can make the actual implementations insecure. Motivated by the idea of measurement-device-independent quantum key distribution (MDI-QKD), we present a measurement-device-independent QDS (MDI-QDS) scheme, which is secure against all detector side-channel attacks. Based on the rapid development of practical MDI-QKD, our MDI-QDS protocol could also be experimentally implemented, since it requires a similar experimental setup.

Developing measurement indices to enhance protection and resilience of critical infrastructure and key resources.

PubMed

Fisher, Ronald E; Norman, Michael

2010-07-01

The US Department of Homeland Security (DHS) is developing indices to better assist in the risk management of critical infrastructures. The first of these indices is the Protective Measures Index - a quantitative index that measures overall protection across component categories: physical security, security management, security force, information sharing, protective measures and dependencies. The Protective Measures Index, which can also be recalculated as the Vulnerability Index, is a way to compare differing protective measures (eg fence versus security training). The second of these indices is the Resilience Index, which assesses a site's resilience and consists of three primary components: robustness, resourcefulness and recovery. The third index is the Criticality Index, which assesses the importance of a facility. The Criticality Index includes economic, human, governance and mass evacuation impacts. The Protective Measures Index, Resilience Index and Criticality Index are being developed as part of the Enhanced Critical Infrastructure Protection initiative that DHS protective security advisers implement across the nation at critical facilities. This paper describes two core themes: determination of the vulnerability, resilience and criticality of a facility and comparison of the indices at different facilities.

Community development corporations could potentially improve research on causal associations between environmental features and physical activity.

PubMed

Suminski, Richard; Wasserman, Jason A; Mayfield, Carlene A; Kubic, Micah; Porter, Julie

2014-09-01

Community development corporations (CDC) are worldwide entities that create environments facilitating physical activity. At the same time, researchers face challenges conducting cost-effective, longitudinal studies on how environmental changes affect physical activity. To provide evidence suggesting that CDC initiatives could potentially be integrated into a research framework for examining the influence of environmental improvements on physical activity. Quality of Life Plans (QLP) developed by a CDC and stakeholders from 6 lower-income neighborhoods were systematically reviewed to obtain data about environmental features targeted for change and the strategies used to bring about those changes. Strategies were deemed pro-physical activity if previous studies suggested they have the potential to affect physical activity. A total of 348 strategies were proposed of which 164 were pro-physical activity. Six environmental features were targeted including crime (57 strategies), aesthetics (39), facilities (30), walkability (17), destinations (14), and programs (5). Strategies involved implementing (90 strategies), planning (33), assessing (26), and securing funding (13). Progress reports indicated that 37.4% of the pro-physical activity strategies were implemented 1 year following the development of the QLPs. These results suggest that activities of CDCs could potentially be systematically integrated into the scientific study of environmental influences on physical activity.

A Model Based Security Testing Method for Protocol Implementation

PubMed Central

Fu, Yu Long; Xin, Xiao Long

2014-01-01

The security of protocol implementation is important and hard to be verified. Since the penetration testing is usually based on the experience of the security tester and the specific protocol specifications, a formal and automatic verification method is always required. In this paper, we propose an extended model of IOLTS to describe the legal roles and intruders of security protocol implementations, and then combine them together to generate the suitable test cases to verify the security of protocol implementation. PMID:25105163

A model based security testing method for protocol implementation.

PubMed

Fu, Yu Long; Xin, Xiao Long

2014-01-01

The security of protocol implementation is important and hard to be verified. Since the penetration testing is usually based on the experience of the security tester and the specific protocol specifications, a formal and automatic verification method is always required. In this paper, we propose an extended model of IOLTS to describe the legal roles and intruders of security protocol implementations, and then combine them together to generate the suitable test cases to verify the security of protocol implementation.

EEL hits provision of NRC's proposed security rules

DOE Office of Scientific and Technical Information (OSTI.GOV)

Not Available

1985-06-01

The Edison Electric Institute (EEI) opposes key provisions in the Nuclear Regulatory Commission's proposed rules for the security of nuclear plants. The objections focus on areas of nuclear plant access, physical protection of facilities, and personal searches. EEI feels that the nuclear industry has implemented effective access measures to provide reasonable assurance against insider threats. It objects to the proposal that workers denied access authorization could petition for a review of their case under conventional labor-management collective bargaining agreements. A counter-proposal by EEI exempts authorizes employees from pat-down searches on the grounds that such searches will make employees unhappy andmore » lower productivity.« less

A randomised controlled trial of an intervention to facilitate the implementation of healthy eating and physical activity policies and practices in childcare services

PubMed Central

Jones, Jannah; Wolfenden, Luke; Wyse, Rebecca; Finch, Meghan; Yoong, Sze Lin; Dodds, Pennie; Pond, Nicole; Gillham, Karen; Freund, Megan; McElduff, Patrick; Wye, Paula; Wiggers, John

2014-01-01

Introduction Childhood overweight and obesity tracks into adulthood, increasing the risk of developing future chronic disease. Implementing initiatives promoting healthy eating and physical activity in childcare settings has been identified as a priority to prevent excessive child weight gain. Despite this, few trials have been conducted to assess the effectiveness of interventions to support population-wide implementation of such initiatives. The aim of this study is to assess the effectiveness of a multicomponent intervention in increasing the implementation of healthy eating and physical activity policies and practices by centre-based childcare services. Methods and analysis The study will employ a parallel group randomised controlled trial design. A sample of 128 childcare services in the Hunter region of New South Wales, Australia, will be recruited to participate in the trial. 64 services will be randomly allocated to a 12-month implementation intervention. The remaining 64 services will be allocated to a usual care control group. The intervention will consist of a number of strategies to facilitate childcare service implementation of healthy eating and physical activity policies and practices. Intervention strategies will include implementation support staff, securing executive support, consensus processes, staff training, academic detailing visits, performance monitoring and feedback, tools and resources, and a communications strategy. The primary outcome of the trial will be the prevalence of services implementing all healthy eating and physical activity policies and practices targeted by the intervention. To assess the effectiveness of the intervention, telephone surveys with nominated supervisors and room leaders of childcare services will be conducted at baseline and immediately postintervention. Ethics and dissemination The study was approved by the Hunter New England Human Research Ethics Committee and the University of Newcastle Human Research Ethics Committee. Study findings will be disseminated widely through peer-reviewed publications and conference presentations. Trial registration number Australian Clinical Trials Registry ACTRN12612000927820. PMID:24742978

49 CFR 1548.5 - Adoption and implementation of the security program.

Code of Federal Regulations, 2014 CFR

2014-10-01

... carrier having a security program must: (1) Maintain an original of the security program at its corporate... 49 Transportation 9 2014-10-01 2014-10-01 false Adoption and implementation of the security...) TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF HOMELAND SECURITY CIVIL AVIATION SECURITY INDIRECT AIR...

49 CFR 1548.5 - Adoption and implementation of the security program.

Code of Federal Regulations, 2010 CFR

2010-10-01

... carrier having a security program must: (1) Maintain an original of the security program at its corporate... 49 Transportation 9 2010-10-01 2010-10-01 false Adoption and implementation of the security...) TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF HOMELAND SECURITY CIVIL AVIATION SECURITY INDIRECT AIR...

49 CFR 1548.5 - Adoption and implementation of the security program.

Code of Federal Regulations, 2013 CFR

2013-10-01

... carrier having a security program must: (1) Maintain an original of the security program at its corporate... 49 Transportation 9 2013-10-01 2013-10-01 false Adoption and implementation of the security...) TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF HOMELAND SECURITY CIVIL AVIATION SECURITY INDIRECT AIR...

49 CFR 1548.5 - Adoption and implementation of the security program.

Code of Federal Regulations, 2011 CFR

2011-10-01

... carrier having a security program must: (1) Maintain an original of the security program at its corporate... 49 Transportation 9 2011-10-01 2011-10-01 false Adoption and implementation of the security...) TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF HOMELAND SECURITY CIVIL AVIATION SECURITY INDIRECT AIR...

High-capacity quantum key distribution via hyperentangled degrees of freedom

NASA Astrophysics Data System (ADS)

Simon, David S.; Sergienko, Alexander V.

2014-06-01

Quantum key distribution (QKD) has long been a promising area for the application of quantum effects in solving real-world problems. However, two major obstacles have stood in the way of its widespread application: low secure key generation rates and short achievable operating distances. In this paper, a new physical mechanism for dealing with the first of these problems is proposed: the interplay between different degrees of freedom in a hyperentangled system (parametric down-conversion) is used to increase the Hilbert space dimension available for key generation while maintaining security. Polarization-based Bell tests provide security checking, while orbital angular momentum (OAM) and total angular momentum (TAM) provide a higher key generation rate. Whether to measure TAM or OAM is decided randomly in each trial. The concurrent noncommutativity of TAM with OAM and polarization provides the physical basis for quantum security. TAM measurements link polarization to OAM, so that if the legitimate participants measure OAM while the eavesdropper measures TAM (or vice-versa), then polarization entanglement is lost, revealing the eavesdropper. In contrast to other OAM-based QKD methods, complex active switching between OAM bases is not required; instead, passive switching by beam splitters combined with much simpler active switching between polarization bases makes implementation at high OAM more practical.

6 CFR 27.115 - Implementation.

Code of Federal Regulations, 2012 CFR

2012-01-01

... 6 Domestic Security 1 2012-01-01 2012-01-01 false Implementation. 27.115 Section 27.115 Domestic Security DEPARTMENT OF HOMELAND SECURITY, OFFICE OF THE SECRETARY CHEMICAL FACILITY ANTI-TERRORISM STANDARDS General § 27.115 Implementation. The Assistant Secretary may implement the section 550 program in...

6 CFR 27.115 - Implementation.

Code of Federal Regulations, 2011 CFR

2011-01-01

... 6 Domestic Security 1 2011-01-01 2011-01-01 false Implementation. 27.115 Section 27.115 Domestic Security DEPARTMENT OF HOMELAND SECURITY, OFFICE OF THE SECRETARY CHEMICAL FACILITY ANTI-TERRORISM STANDARDS General § 27.115 Implementation. The Assistant Secretary may implement the section 550 program in...

6 CFR 27.115 - Implementation.

Code of Federal Regulations, 2013 CFR

2013-01-01

... 6 Domestic Security 1 2013-01-01 2013-01-01 false Implementation. 27.115 Section 27.115 Domestic Security DEPARTMENT OF HOMELAND SECURITY, OFFICE OF THE SECRETARY CHEMICAL FACILITY ANTI-TERRORISM STANDARDS General § 27.115 Implementation. The Assistant Secretary may implement the section 550 program in...

6 CFR 27.115 - Implementation.

Code of Federal Regulations, 2010 CFR

2010-01-01

... 6 Domestic Security 1 2010-01-01 2010-01-01 false Implementation. 27.115 Section 27.115 Domestic Security DEPARTMENT OF HOMELAND SECURITY, OFFICE OF THE SECRETARY CHEMICAL FACILITY ANTI-TERRORISM STANDARDS General § 27.115 Implementation. The Assistant Secretary may implement the Section 550 program in...

6 CFR 27.115 - Implementation.

Code of Federal Regulations, 2014 CFR

2014-01-01

... 6 Domestic Security 1 2014-01-01 2014-01-01 false Implementation. 27.115 Section 27.115 Domestic Security DEPARTMENT OF HOMELAND SECURITY, OFFICE OF THE SECRETARY CHEMICAL FACILITY ANTI-TERRORISM STANDARDS General § 27.115 Implementation. The Assistant Secretary may implement the section 550 program in...

21 CFR 1301.73 - Physical security controls for non-practitioners; compounders for narcotic treatment programs...

Code of Federal Regulations, 2010 CFR

2010-04-01

... 21 Food and Drugs 9 2010-04-01 2010-04-01 false Physical security controls for non-practitioners..., DISTRIBUTORS, AND DISPENSERS OF CONTROLLED SUBSTANCES Security Requirements § 1301.73 Physical security... adequate security for the area or building. If such security requires an alarm, such alarm, upon...

6 CFR 37.15 - Physical security features for the driver's license or identification card.

Code of Federal Regulations, 2010 CFR

2010-01-01

... 6 Domestic Security 1 2010-01-01 2010-01-01 false Physical security features for the driver's license or identification card. 37.15 Section 37.15 Domestic Security DEPARTMENT OF HOMELAND SECURITY..., Verification, and Card Issuance Requirements § 37.15 Physical security features for the driver's license or...

78 FR 59981 - Proposed Revision to Physical Security-Standard Design Certification and Operating Reactors

Federal Register 2010, 2011, 2012, 2013, 2014

2013-09-30

... the Standard Review Plan (SRP), concerning the physical security reviews of design certification... NRC staff with the physical security review of applications for design certifications, incorporate... NUCLEAR REGULATORY COMMISSION [NRC-2013-0225] Proposed Revision to Physical Security--Standard...

What Practices in Airport Security Should the United States Implement at Commercial Airports in Light of the Events of September 11, 2001?

DTIC Science & Technology

2002-06-01

NAVAL POSTGRADUATE SCHOOL Monterey, California THESIS WHAT PRACTICES IN AIRPORT SECURITY SHOULD THE UNITED STATES IMPLEMENT AT...COVERED Master’s Thesis 4. TITLE AND SUBTITLE What Practices in Airport Security Should the United States Implement at Commercial...complacency and conflicts of interest. 14. SUBJECT TERMS Airport Security , Aviation Security Systems, Terrorism, Hijacking

Beyond grid security

NASA Astrophysics Data System (ADS)

Hoeft, B.; Epting, U.; Koenig, T.

2008-07-01

While many fields relevant to Grid security are already covered by existing working groups, their remit rarely goes beyond the scope of the Grid infrastructure itself. However, security issues pertaining to the internal set-up of compute centres have at least as much impact on Grid security. Thus, this talk will present briefly the EU ISSeG project (Integrated Site Security for Grids). In contrast to groups such as OSCT (Operational Security Coordination Team) and JSPG (Joint Security Policy Group), the purpose of ISSeG is to provide a holistic approach to security for Grid computer centres, from strategic considerations to an implementation plan and its deployment. The generalised methodology of Integrated Site Security (ISS) is based on the knowledge gained during its implementation at several sites as well as through security audits, and this will be briefly discussed. Several examples of ISS implementation tasks at the Forschungszentrum Karlsruhe will be presented, including segregation of the network for administration and maintenance and the implementation of Application Gateways. Furthermore, the web-based ISSeG training material will be introduced. This aims to offer ISS implementation guidance to other Grid installations in order to help avoid common pitfalls.

Effectiveness of the Civil Aviation Security Program.

DTIC Science & Technology

1980-05-22

SECURITY. - CONTINUED TRAINING OF LAW ENFORCEMENT OFFICERS SUPPORTING AIRPORT SECURITY ACTIVITIES. - SECURITY PROGRAMS IMPLEMENTED BY AIR FREIGHT...cooperation by all concerned. (See Exhibit 14) Airport Security - Ongoing activities which contributed significantly to airport security included full...implementation of the revised Federal Aviation Regulations (FAR) Part 107 governing airport security , training of law enforcement officers supporting

10 CFR 110.44 - Physical security standards.

Code of Federal Regulations, 2010 CFR

2010-01-01

... 10 Energy 2 2010-01-01 2010-01-01 false Physical security standards. 110.44 Section 110.44 Energy NUCLEAR REGULATORY COMMISSION (CONTINUED) EXPORT AND IMPORT OF NUCLEAR EQUIPMENT AND MATERIAL Review of License Applications § 110.44 Physical security standards. (a) Physical security measures in recipient...

49 CFR 1549.5 - Adoption and implementation of the security program.

Code of Federal Regulations, 2013 CFR

2013-10-01

... facility must: (1) Maintain an original of the security program at its corporate office. (2) Have... 49 Transportation 9 2013-10-01 2013-10-01 false Adoption and implementation of the security...) TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF HOMELAND SECURITY CIVIL AVIATION SECURITY CERTIFIED CARGO...

49 CFR 1549.5 - Adoption and implementation of the security program.

Code of Federal Regulations, 2011 CFR

2011-10-01

... facility must: (1) Maintain an original of the security program at its corporate office. (2) Have... 49 Transportation 9 2011-10-01 2011-10-01 false Adoption and implementation of the security...) TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF HOMELAND SECURITY CIVIL AVIATION SECURITY CERTIFIED CARGO...

49 CFR 1549.5 - Adoption and implementation of the security program.

Code of Federal Regulations, 2014 CFR

2014-10-01

... facility must: (1) Maintain an original of the security program at its corporate office. (2) Have... 49 Transportation 9 2014-10-01 2014-10-01 false Adoption and implementation of the security...) TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF HOMELAND SECURITY CIVIL AVIATION SECURITY CERTIFIED CARGO...

49 CFR 1549.5 - Adoption and implementation of the security program.

Code of Federal Regulations, 2010 CFR

2010-10-01

... facility must: (1) Maintain an original of the security program at its corporate office. (2) Have... 49 Transportation 9 2010-10-01 2010-10-01 false Adoption and implementation of the security...) TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF HOMELAND SECURITY CIVIL AVIATION SECURITY CERTIFIED CARGO...

49 CFR 1549.5 - Adoption and implementation of the security program.

Code of Federal Regulations, 2012 CFR

2012-10-01

... facility must: (1) Maintain an original of the security program at its corporate office. (2) Have... 49 Transportation 9 2012-10-01 2012-10-01 false Adoption and implementation of the security...) TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF HOMELAND SECURITY CIVIL AVIATION SECURITY CERTIFIED CARGO...

Securing While Sampling in Wireless Body Area Networks With Application to Electrocardiography.

PubMed

Dautov, Ruslan; Tsouri, Gill R

2016-01-01

Stringent resource constraints and broadcast transmission in wireless body area network raise serious security concerns when employed in biomedical applications. Protecting data transmission where any minor alteration is potentially harmful is of significant importance in healthcare. Traditional security methods based on public or private key infrastructure require considerable memory and computational resources, and present an implementation obstacle in compact sensor nodes. This paper proposes a lightweight encryption framework augmenting compressed sensing with wireless physical layer security. Augmenting compressed sensing to secure information is based on the use of the measurement matrix as an encryption key, and allows for incorporating security in addition to compression at the time of sampling an analog signal. The proposed approach eliminates the need for a separate encryption algorithm, as well as the predeployment of a key thereby conserving sensor node's limited resources. The proposed framework is evaluated using analysis, simulation, and experimentation applied to a wireless electrocardiogram setup consisting of a sensor node, an access point, and an eavesdropper performing a proximity attack. Results show that legitimate communication is reliable and secure given that the eavesdropper is located at a reasonable distance from the sensor node and the access point.

27 CFR 19.153 - Statement of physical security.

Code of Federal Regulations, 2010 CFR

2010-04-01

... 27 Alcohol, Tobacco Products and Firearms 1 2010-04-01 2010-04-01 false Statement of physical... Plants § 19.153 Statement of physical security. (a) Content. The statement of security shall include: (1) A general description of the physical security at the distilled spirits plant, including methods...

On protection against a bright-pulse attack in the two-pass quantum cryptography system

NASA Astrophysics Data System (ADS)

Balygin, K. A.; Klimov, A. N.; Korol'kov, A. V.; Kulik, S. P.; Molotkov, S. N.

2016-06-01

The security of keys in quantum cryptography systems, in contrast to mathematical cryptographic algorithms, is guaranteed by fundamental quantum-mechanical laws. However, the cryptographic resistance of such systems, which are distributed physical devices, fundamentally depends on the method of their implementation and particularly on the calibration and control of critical parameters. The most important parameter is the number of photons in quasi-single-photon information states in a communication channel. The sensitivity to a bright-pulse attack has been demonstrated in an explicit form for a number of systems. A method guaranteeing the resistance to such attacks has been proposed and implemented. Furthermore, the relation of physical observables used and obtained at the control of quantum states to the length of final secret keys has been obtained for the first time.

Electronic patient record and archive of records in Cardio.net system for telecardiology.

PubMed

Sierdziński, Janusz; Karpiński, Grzegorz

2003-01-01

In modern medicine the well structured patient data set, fast access to it and reporting capability become an important question. With the dynamic development of information technology (IT) such question is solved via building electronic patient record (EPR) archives. We then obtain fast access to patient data, diagnostic and treatment protocols etc. It results in more efficient, better and cheaper treatment. The aim of the work was to design a uniform Electronic Patient Record, implemented in cardio.net system for telecardiology allowing the co-operation among regional hospitals and reference centers. It includes questionnaires for demographic data and questionnaires supporting doctor's work (initial diagnosis, final diagnosis, history and physical, ECG at the discharge, applied treatment, additional tests, drugs, daily and periodical reports). The browser is implemented in EPR archive to facilitate data retrieval. Several tools for creating EPR and EPR archive were used such as: XML, PHP, Java Script and MySQL. The separate question is the security of data on WWW server. The security is ensured via Security Socket Layer (SSL) protocols and other tools. EPR in Cardio.net system is a module enabling the co-work of many physicians and the communication among different medical centers.

An enhanced security solution for electronic medical records based on AES hybrid technique with SOAP/XML and SHA-1.

PubMed

Kiah, M L Mat; Nabi, Mohamed S; Zaidan, B B; Zaidan, A A

2013-10-01

This study aims to provide security solutions for implementing electronic medical records (EMRs). E-Health organizations could utilize the proposed method and implement recommended solutions in medical/health systems. Majority of the required security features of EMRs were noted. The methods used were tested against each of these security features. In implementing the system, the combination that satisfied all of the security features of EMRs was selected. Secure implementation and management of EMRs facilitate the safeguarding of the confidentiality, integrity, and availability of e-health organization systems. Health practitioners, patients, and visitors can use the information system facilities safely and with confidence anytime and anywhere. After critically reviewing security and data transmission methods, a new hybrid method was proposed to be implemented on EMR systems. This method will enhance the robustness, security, and integration of EMR systems. The hybrid of simple object access protocol/extensible markup language (XML) with advanced encryption standard and secure hash algorithm version 1 has achieved the security requirements of an EMR system with the capability of integrating with other systems through the design of XML messages.

DARPA Quantum Network Testbed

DTIC Science & Technology

2007-07-01

End-to-End Security with Photonic Switching...............................28 8.4 Year 3 – Adding a Link that implements Entanglement -Based QKD... entangled photon pairs at 1550nm. • Built a highspeed (~10 MHz) physical random number generator, and integrated it into Bob. This design provides an...each kind of photonic setup in the Quantum Network, i.e., over time it will grow to include descriptions of the weak-coherent link, the entangled

Quantum Proxy Multi-Signature Scheme Using Genuinely Entangled Six Qubits State

NASA Astrophysics Data System (ADS)

Cao, Hai-Jing; Wang, Huai-Sheng; Li, Peng-Fei

2013-04-01

A quantum proxy multi-signature scheme is presented based on controlled teleportation. Genuinely entangled six qubits quantum state functions as quantum channel. The scheme uses the physical characteristics of quantum mechanics to implement delegation, signature and verification. Quantum key distribution and one-time pad are adopted in our scheme, which could guarantee not only the unconditional security of the scheme but also the anonymity of the messages owner.

Cyber-Physical System Security With Deceptive Virtual Hosts for Industrial Control Networks

DOE PAGES

Vollmer, Todd; Manic, Milos

2014-05-01

A challenge facing industrial control network administrators is protecting the typically large number of connected assets for which they are responsible. These cyber devices may be tightly coupled with the physical processes they control and human induced failures risk dire real-world consequences. Dynamic virtual honeypots are effective tools for observing and attracting network intruder activity. This paper presents a design and implementation for self-configuring honeypots that passively examine control system network traffic and actively adapt to the observed environment. In contrast to prior work in the field, six tools were analyzed for suitability of network entity information gathering. Ettercap, anmore » established network security tool not commonly used in this capacity, outperformed the other tools and was chosen for implementation. Utilizing Ettercap XML output, a novel four-step algorithm was developed for autonomous creation and update of a Honeyd configuration. This algorithm was tested on an existing small campus grid and sensor network by execution of a collaborative usage scenario. Automatically created virtual hosts were deployed in concert with an anomaly behavior (AB) system in an attack scenario. Virtual hosts were automatically configured with unique emulated network stack behaviors for 92% of the targeted devices. The AB system alerted on 100% of the monitored emulated devices.« less

An Empirical Examination of Fear Appeal's Effect on Behavioral Intention to Comply with Anti-Spyware Software Information Security Recommendations among College Students

ERIC Educational Resources Information Center

Brown, David A.

2017-01-01

Information security is a concern for managers implementing protection measures. Implementing information security measures requires communicating both the reason and remediation for the protection measure. Examining how an anti-spyware security communication affects an individual's intention to implement a protection measure could help improve…

INVITED PAPER: Low power cryptography

NASA Astrophysics Data System (ADS)

Kitsos, P.; Koufopavlou, O.; Selimis, G.; Sklavos, N.

2005-01-01

Today more and more sensitive data is stored digitally. Bank accounts, medical records and personal emails are some categories that data must keep secure. The science of cryptography tries to encounter the lack of security. Data confidentiality, authentication, non-reputation and data integrity are some of the main parts of cryptography. The evolution of cryptography drove in very complex cryptographic models which they could not be implemented before some years. The use of systems with increasing complexity, which usually are more secure, has as result low throughput rate and more energy consumption. However the evolution of cipher has no practical impact, if it has only theoretical background. Every encryption algorithm should exploit as much as possible the conditions of the specific system without omitting the physical, area and timing limitations. This fact requires new ways in design architectures for secure and reliable crypto systems. A main issue in the design of crypto systems is the reduction of power consumption, especially for portable systems as smart cards.

Measurement-device-independent quantum cryptography

DOE PAGES

Xu, Feihu; Curty, Marcos; Qi, Bing; ...

2014-12-18

In theory, quantum key distribution (QKD) provides information-theoretic security based on the laws of physics. Owing to the imperfections of real-life implementations, however, there is a big gap between the theory and practice of QKD, which has been recently exploited by several quantum hacking activities. To fill this gap, a novel approach, called measurement-device-independent QKD (mdiQKD), has been proposed. In addition, it can remove all side-channels from the measurement unit, arguably the most vulnerable part in QKD systems, thus offering a clear avenue toward secure QKD realisations. In this study, we review the latest developments in the framework of mdiQKD,more » together with its assumptions, strengths, and weaknesses.« less

The hobbyist phenomenon in physical security.

DOE Office of Scientific and Technical Information (OSTI.GOV)

Michaud, E. C.

Pro-Ams (professional amateurs) are groups of people who work on a problem as amateurs or unpaid persons in a given field at professional levels of competence. Astronomy is a good example of Pro-Am activity. At Galaxy Zoo, Pro-Ams evaluate data generated by professional observatories and are able to evaluate the millions of galaxies that have been observed but not classified, and report their findings at professional levels for fun. To allow the archiving of millions of galaxies that have been observed but not classified, the website has been engineered so that the public can view and classify galaxies even ifmore » they are not professional astronomers. In this endeavor, it has been found that amateurs can easily outperform automated vision systems. Today in the world of physical security, Pro-Ams are playing an ever-increasing role. Traditionally, locksmiths, corporations, and government organizations have been largely responsible for developing standards, uncovering vulnerabilities, and devising best security practices. Increasingly, however, nonprofit sporting organizations and clubs are doing this. They can be found all over the world, from Europe to the US and now South East Asia. Examples include TOOOL (The Open Organization of Lockpickers), the Longhorn Lockpicking Club, Sportsfreunde der Sperrtechnik - Deustcheland e.V., though there are many others. Members of these groups have been getting together weekly to discuss many elements of security, with some groups specializing in specific areas of security. When members are asked why they participate in these hobbyist groups, they usually reply (with gusto) that they do it for fun, and that they view defeating locks and other security devices as an interesting and entertaining puzzle. A lot of what happens at these clubs would not be possible if it weren't for 'Super Abundance', the ability to easily acquire (at little or no cost) the products, security tools, technologies, and intellectual resources traditionally limited to corporations, government organizations, or wealthy individuals. With this new access comes new discoveries. For example, hobbyist sport lockpicking groups discovered - and publicized - a number of new vulnerabilities between 2004 and 2009 that resulted in the majority of high-security lock manufacturers having to make changes and improvements to their products. A decade ago, amateur physical security discoveries were rare, at least those discussed publicly. In the interim, Internet sites such as lockpicking.org, lockpicking101.com and others have provided an online meeting place for people to trade tips, find friends with similar interests, and develop tools. The open, public discussion of software vulnerabilities, in contrast, has been going on for a long time. These two industries, physical security and software, have very different upgrade mechanisms. With software, a patch can typically be deployed quickly to fix a serious vulnerability, whereas a hardware fix for a physical security device or system can take upwards of months to implement in the field, especially if (as is often the case) hardware integrators are involved. Even when responding to publicly announced security vulnerabilities, manufacturers of physical security devices such as locks, intrusion detectors, or access control devices rarely view hobbyists as a positive resource. This is most unfortunate. In the field of software, it is common to speak of Open Source versus Closed Source. An Open Source software company may choose to distribute their software with a particular license, and give it away openly, with full details and all the lines of source code made available. Linux is a very popular example of this. A Close Source company, in contrast, chooses not to reveal its source code and will license its software products in a restrictive manor. Slowly, the idea of Open Source is now coming to the world of physical security. In the case of locks, it provides an alternative to the traditional Closed Source world of locksmiths. Now locks are physical objects, and can therefore be disassembled. As such, they have always been Open Source in a limited sense. Secrecy, in fact, is very difficult to maintain for a lock that is widely distributed. Having direct access to the lock design provides the hobbyist with a very open environment for finding security flaws, even if the lock manufacturer attempts to follow a Close Source model. It is clear that the field of physical security is going the digital route with companies such as Medeco, Mul-T-Lock, and Abloy manufacturing electromechanical locks. Various companies have already begun to add microcontrollers, cryptographic chip sets, solid-state sensors, and a number of other high-tech improvements to their product lineup in an effort to thwart people from defeating their security products.« less

45 CFR 164.306 - Security standards: General rules.

Code of Federal Regulations, 2012 CFR

2012-10-01

... RELATED REQUIREMENTS SECURITY AND PRIVACY Security Standards for the Protection of Electronic Protected Health Information § 164.306 Security standards: General rules. (a) General requirements. Covered... covered entity to reasonably and appropriately implement the standards and implementation specifications...

45 CFR 164.306 - Security standards: General rules.

Code of Federal Regulations, 2013 CFR

2013-10-01

... RELATED REQUIREMENTS SECURITY AND PRIVACY Security Standards for the Protection of Electronic Protected Health Information § 164.306 Security standards: General rules. (a) General requirements. Covered... and appropriately implement the standards and implementation specifications as specified in this...

Analysis of information security management systems at 5 domestic hospitals with more than 500 beds.

PubMed

Park, Woo-Sung; Seo, Sun-Won; Son, Seung-Sik; Lee, Mee-Jeong; Kim, Shin-Hyo; Choi, Eun-Mi; Bang, Ji-Eon; Kim, Yea-Eun; Kim, Ok-Nam

2010-06-01

The information security management systems (ISMS) of 5 hospitals with more than 500 beds were evaluated with regards to the level of information security, management, and physical and technical aspects so that we might make recommendations on information security and security countermeasures which meet both international standards and the needs of individual hospitals. The ISMS check-list derived from international/domestic standards was distributed to each hospital to complete and the staff of each hospital was interviewed. Information Security Indicator and Information Security Values were used to estimate the present security levels and evaluate the application of each hospital's current system. With regard to the moderate clause of the ISMS, the hospitals were determined to be in compliance. The most vulnerable clause was asset management, in particular, information asset classification guidelines. The clauses of information security incident management and business continuity management were deemed necessary for the establishment of successful ISMS. The level of current ISMS in the hospitals evaluated was determined to be insufficient. Establishment of adequate ISMS is necessary to ensure patient privacy and the safe use of medical records for various purposes. Implementation of ISMS which meet international standards with a long-term and comprehensive perspective is of prime importance. To reflect the requirements of the varied interests of medical staff, consumers, and institutions, the establishment of political support is essential to create suitable hospital ISMS.

Risk assessment for Industrial Control Systems quantifying availability using mean failure cost (MFC)

DOE PAGES

Chen, Qian; Abercrombie, Robert K; Sheldon, Frederick T.

2015-09-23

Industrial Control Systems (ICS) are commonly used in industries such as oil and natural gas, transportation, electric, water and wastewater, chemical, pharmaceutical, pulp and paper, food and beverage, as well as discrete manufacturing (e.g., automotive, aerospace, and durable goods.) SCADA systems are generally used to control dispersed assets using centralized data acquisition and supervisory control.Originally, ICS implementations were susceptible primarily to local threats because most of their components were located in physically secure areas (i.e., ICS components were not connected to IT networks or systems). The trend toward integrating ICS systems with IT networks (e.g., efficiency and the Internet ofmore » Things) provides significantly less isolation for ICS from the outside world thus creating greater risk due to external threats. Albeit, the availability of ICS/SCADA systems is critical to assuring safety, security and profitability. Such systems form the backbone of our national cyber-physical infrastructure.Herein, we extend the concept of mean failure cost (MFC) to address quantifying availability to harmonize well with ICS security risk assessment. This new measure is based on the classic formulation of Availability combined with Mean Failure Cost (MFC). Finally, the metric offers a computational basis to estimate the availability of a system in terms of the loss that each stakeholder stands to sustain as a result of security violations or breakdowns (e.g., deliberate malicious failures).« less

5 CFR 2500.11 - Implementation and review.

Code of Federal Regulations, 2011 CFR

2011-01-01

... INFORMATION SECURITY REGULATION § 2500.11 Implementation and review. The Information Security Oversight... information security program. The chairperson shall also be responsible for conducting an active oversight...

5 CFR 2500.11 - Implementation and review.

Code of Federal Regulations, 2010 CFR

2010-01-01

... INFORMATION SECURITY REGULATION § 2500.11 Implementation and review. The Information Security Oversight... information security program. The chairperson shall also be responsible for conducting an active oversight...

Unconditional security from noisy quantum storage

NASA Astrophysics Data System (ADS)

Wehner, Stephanie

2010-03-01

We consider the implementation of two-party cryptographic primitives based on the sole physical assumption that no large-scale reliable quantum storage is available to the cheating party. An important example of such a task is secure identification. Here, Alice wants to identify herself to Bob (possibly an ATM machine) without revealing her password. More generally, Alice and Bob wish to solve problems where Alice holds an input x (e.g. her password), and Bob holds an input y (e.g. the password an honest Alice should possess), and they want to obtain the value of some function f(x,y) (e.g. the equality function). Security means that the legitimate users should not learn anything beyond this specification. That is, Alice should not learn anything about y and Bob should not learn anything about x, other than what they may be able to infer from the value of f(x,y). We show that any such problem can be solved securely in the noisy-storage model by constructing protocols for bit commitment and oblivious transfer, where we prove security against the most general attack. Our protocols can be implemented with present-day hardware used for quantum key distribution. In particular, no quantum storage is required for the honest parties. Our work raises a large number of immediate theoretical as well as experimental questions related to many aspects of quantum information science, such as for example understanding the information carrying properties of quantum channels and memories, randomness extraction, min-entropy sampling, as well as constructing small handheld devices which are suitable for the task of secure identification. [4pt] Full version available at arXiv:0906.1030 (theoretical) and arXiv:0911.2302 (practically oriented).

75 FR 43528 - Seeking Public Comment on Draft National Health Security Strategy Biennial Implementation Plan

Federal Register 2010, 2011, 2012, 2013, 2014

2010-07-26

... DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary Seeking Public Comment on Draft National Health Security Strategy Biennial Implementation Plan AGENCY: Department of Health and Human... Interim Implementation Guide for the National Health Security Strategy of the United States of America...

Sandia National Laboratories analysis code data base

NASA Astrophysics Data System (ADS)

Peterson, C. W.

1994-11-01

Sandia National Laboratories' mission is to solve important problems in the areas of national defense, energy security, environmental integrity, and industrial technology. The laboratories' strategy for accomplishing this mission is to conduct research to provide an understanding of the important physical phenomena underlying any problem, and then to construct validated computational models of the phenomena which can be used as tools to solve the problem. In the course of implementing this strategy, Sandia's technical staff has produced a wide variety of numerical problem-solving tools which they use regularly in the design, analysis, performance prediction, and optimization of Sandia components, systems, and manufacturing processes. This report provides the relevant technical and accessibility data on the numerical codes used at Sandia, including information on the technical competency or capability area that each code addresses, code 'ownership' and release status, and references describing the physical models and numerical implementation.

Semiannual Report to Congress on the Effectiveness of the Civil Aviation Security Program.

DTIC Science & Technology

1987-12-31

This report also provides data on the initiatives being implemented as a result of the review of domestic airport security by the Secretary’s Safety...enforcement support for airline and airport security measures. Finally, the passengers-the ultimate beneficiaries of the security program--pay for...of these airports is required to implement a security program which provides a secure operating environment for these air carriers. Airport security programs

A Cryptographic SoC for Robust Protection of Secret Keys in IPTV DRM Systems

NASA Astrophysics Data System (ADS)

Lee, Sanghan; Yang, Hae-Yong; Yeom, Yongjin; Park, Jongsik

The security level of an internet protocol television (IPTV) digital right management (DRM) system ultimately relies on protection of secret keys. Well known devices for the key protection include smartcards and battery backup SRAMs (BB-SRAMs); however, these devices could be vulnerable to various physical attacks. In this paper, we propose a secure and cost-effective design of a cryptographic system on chip (SoC) that integrates the BB-SRAM with a cell-based design technique. The proposed SoC provides robust safeguard against the physical attacks, and satisfies high-speed and low-price requirements of IPTV set-top boxes. Our implementation results show that the maximum encryption rate of the SoC is 633Mb/s. In order to verify the data retention capabilities, we made a prototype chip using 0.18µm standard cell technology. The experimental results show that the integrated BB-SRAM can reliably retain data with a 1.4µA leakage current.

Physical and Cross-Layer Security Enhancement and Resource Allocation for Wireless Networks

ERIC Educational Resources Information Center

Bashar, Muhammad Shafi Al

2011-01-01

In this dissertation, we present novel physical (PHY) and cross-layer design guidelines and resource adaptation algorithms to improve the security and user experience in the future wireless networks. Physical and cross-layer wireless security measures can provide stronger overall security with high efficiency and can also provide better…

10 CFR 76.111 - Physical security, material control and accounting, and protection of certain information.

Code of Federal Regulations, 2012 CFR

2012-01-01

... 10 Energy 2 2012-01-01 2012-01-01 false Physical security, material control and accounting, and protection of certain information. 76.111 Section 76.111 Energy NUCLEAR REGULATORY COMMISSION (CONTINUED) CERTIFICATION OF GASEOUS DIFFUSION PLANTS Safeguards and Security § 76.111 Physical security, material control...

10 CFR 76.111 - Physical security, material control and accounting, and protection of certain information.

Code of Federal Regulations, 2011 CFR

2011-01-01

... 10 Energy 2 2011-01-01 2011-01-01 false Physical security, material control and accounting, and protection of certain information. 76.111 Section 76.111 Energy NUCLEAR REGULATORY COMMISSION (CONTINUED) CERTIFICATION OF GASEOUS DIFFUSION PLANTS Safeguards and Security § 76.111 Physical security, material control...

10 CFR 76.111 - Physical security, material control and accounting, and protection of certain information.

Code of Federal Regulations, 2014 CFR

2014-01-01

... 10 Energy 2 2014-01-01 2014-01-01 false Physical security, material control and accounting, and protection of certain information. 76.111 Section 76.111 Energy NUCLEAR REGULATORY COMMISSION (CONTINUED) CERTIFICATION OF GASEOUS DIFFUSION PLANTS Safeguards and Security § 76.111 Physical security, material control...

10 CFR 76.111 - Physical security, material control and accounting, and protection of certain information.

Code of Federal Regulations, 2013 CFR

2013-01-01

... 10 Energy 2 2013-01-01 2013-01-01 false Physical security, material control and accounting, and protection of certain information. 76.111 Section 76.111 Energy NUCLEAR REGULATORY COMMISSION (CONTINUED) CERTIFICATION OF GASEOUS DIFFUSION PLANTS Safeguards and Security § 76.111 Physical security, material control...

SPAN security policies and guidelines

NASA Technical Reports Server (NTRS)

Sisson, Patricia L.; Green, James L.

1989-01-01

A guide is provided to system security with emphasis on requirements and guidelines that are necessary to maintain an acceptable level of security on the network. To have security for the network, each node on the network must be secure. Therefore, each system manager, must strictly adhere to the requirements and must consider implementing the guidelines discussed. There are areas of vulnerability within the operating system that may not be addressed. However, when a requirement or guideline is discussed, implementation techniques are included. Information related to computer and data security is discussed to provide information on implementation options. The information is presented as it relates to a VAX computer environment.

Effect of Organizational Factors on Information Security Implementations

ERIC Educational Resources Information Center

Perez, Rafael G.

2013-01-01

The purpose of this quantitative inferential study is to determine the level of correlation between the organizational factors of information security awareness, balanced security processes, and organizational structure with the size of the estimation gap of information security implementations mediated by the end user intentionality. The study…

U.S.-CHINA RADIOLOGICAL SOURCE SECURITY PROJECT: CONTINUING AND EXPANDING BILATERAL COOPERATION

DOE Office of Scientific and Technical Information (OSTI.GOV)

Zhu, Zhixuan; Zhou, Qifu; Yang, Yaoyun

2009-10-07

The successful radiological security cooperation between the U.S. and China to secure at-risk sites near venues of the 2008 Beijing Summer Olympics has led to an expanded bilateral nonproliferation cooperation scope. The U.S. Department of Energy’s National Nuclear Security Administration, the Chinese Atomic Energy Authority and the China Ministry of Environmental Protection are continuing joint efforts to secure radiological sources throughout China under the U.S.-China Peaceful Uses of Nuclear Technology (PUNT) Agreement. Joint cooperation activities include physical security upgrades of sites with International Atomic Energy Agency (IAEA) Category 1 radiological sources, packaging, recovery, and storage of high activity transuranic andmore » beta gamma sources, and secure transportation practices for the movement of recovered sources. Expansion of cooperation into numerous provinces within China includes the use of integrated training workshops that will demonstrate methodologies and best practices between U.S. and Chinese radiological source security and recovery experts. The fiscal year 2009 expanded scope of cooperation will be conducted similar to the 2008 Olympic cooperation with the Global Threat Reduction Initiative taking the lead for the U.S., PUNT being the umbrella agreement, and Los Alamos, Sandia, and Oak Ridge National Laboratories operating as technical working groups. This paper outlines the accomplishments of the joint implementation and training efforts to date and discusses the possible impact on future U.S./China cooperation.« less

75 FR 13258 - Announcing a Meeting of the Information Security and Privacy Advisory Board

Federal Register 2010, 2011, 2012, 2013, 2014

2010-03-19

.../index.html/ . Agenda: --Cloud Computing Implementations --Health IT --OpenID --Pending Cyber Security... will be available for the public and media. --OpenID --Cloud Computing Implementations --Security...

Recent trends in hardware security exploiting hybrid CMOS-resistive memory circuits

NASA Astrophysics Data System (ADS)

Sahay, Shubham; Suri, Manan

2017-12-01

This paper provides a comprehensive review and insight of recent trends in the field of random number generator (RNG) and physically unclonable function (PUF) circuits implemented using different types of emerging resistive non-volatile (NVM) memory devices. We present a detailed review of hybrid RNG/PUF implementations based on the use of (i) Spin-Transfer Torque (STT-MRAM), and (ii) metal-oxide based (OxRAM), NVM devices. Various approaches on Hybrid CMOS-NVM RNG/PUF circuits are considered, followed by a discussion on different nanoscale device phenomena. Certain nanoscale device phenomena (variability/stochasticity etc), which are otherwise undesirable for reliable memory and storage applications, form the basis for low power and highly scalable RNG/PUF circuits. Detailed qualitative comparison and benchmarking of all implementations is performed.

Effectiveness of an intervention to facilitate the implementation of healthy eating and physical activity policies and practices in childcare services: a randomised controlled trial.

PubMed

Jones, Jannah; Wyse, Rebecca; Finch, Meghan; Lecathelinais, Christophe; Wiggers, John; Marshall, Josephine; Falkiner, Maryann; Pond, Nicole; Yoong, Sze Lin; Hollis, Jenna; Fielding, Alison; Dodds, Pennie; Clinton-McHarg, Tara; Freund, Megan; McElduff, Patrick; Gillham, Karen; Wolfenden, Luke

2015-10-25

The primary aim of this study was to evaluate the effectiveness of an intervention to increase the implementation of healthy eating and physical activity policies and practices by centre-based childcare services. The study also sought to determine if the intervention was effective in improving child dietary intake and increasing child physical activity levels while attending childcare. A parallel group, randomised controlled trial was conducted in a sample of 128 childcare services. Intervention strategies included provision of implementation support staff, securing executive support, staff training, consensus processes, academic detailing visits, tools and resources, performance monitoring and feedback and a communications strategy. The primary outcome of the trial was the proportion of services implementing all seven healthy eating and physical activity policies and practices targeted by the intervention. Outcome data were collected via telephone surveys with nominated supervisors and room leaders at baseline and immediately post-intervention. Secondary trial outcomes included the differences between groups in the number of serves consumed by children for each food group within the Australian Guide to Healthy Eating and in the proportion of children engaged in sedentary, walking or very active physical activity assessed via observation in a random subsample of 36 services at follow-up. There was no significant difference between groups for the primary trial outcome (p = 0.44). Relative to the control group, a significantly larger proportion of intervention group services reported having a written nutrition and physical activity policy (p = 0.05) and providing adult-guided activities to develop fundamental movement skills (p = 0.01). There were no significant differences between groups at follow-up on measures of child dietary intake or physical activity. The findings of the trial were equivocal. While there was no significant difference between groups for the primary trial outcome, the intervention did significantly increase the proportion of intervention group services implementing two of the seven healthy eating and physical activity policies and practices. High levels of implementation of a number of policies and practices at baseline, significant obesity prevention activity in the study region and higher than previously reported intra-class correlation of child behaviours may, in part, explain the trial findings. Australian Clinical Trials Registry (reference ACTRN12612000927820 ).

A Quantum Proxy Blind Signature Scheme Based on Genuine Five-Qubit Entangled State

NASA Astrophysics Data System (ADS)

Zeng, Chuan; Zhang, Jian-Zhong; Xie, Shu-Cui

2017-06-01

In this paper, a quantum proxy blind signature scheme based on controlled quantum teleportation is proposed. This scheme uses a genuine five-qubit entangled state as quantum channel and adopts the classical Vernam algorithm to blind message. We use the physical characteristics of quantum mechanics to implement delegation, signature and verification. Security analysis shows that our scheme is valid and satisfy the properties of a proxy blind signature, such as blindness, verifiability, unforgeability, undeniability.

Web Services Security - Implementation and Evaluation Issues

NASA Astrophysics Data System (ADS)

Pimenidis, Elias; Georgiadis, Christos K.; Bako, Peter; Zorkadis, Vassilis

Web services development is a key theme in the utilization the commercial exploitation of the semantic web. Paramount to the development and offering of such services is the issue of security features and they way these are applied in instituting trust amongst participants and recipients of the service. Implementing such security features is a major challenge to developers as they need to balance these with performance and interoperability requirements. Being able to evaluate the level of security offered is a desirable feature for any prospective participant. The authors attempt to address the issues of security requirements and evaluation criteria, while they discuss the challenges of security implementation through a simple web service application case.

Systematic implementation of spectral CT with a photon counting detector for liquid security inspection

NASA Astrophysics Data System (ADS)

Xu, Xiaofei; Xing, Yuxiang; Wang, Sen; Zhang, Li

2018-06-01

X-ray liquid security inspection system plays an important role in homeland security, while the conventional dual-energy CT (DECT) system may have a big deviation in extracting the atomic number and the electron density of materials in various conditions. Photon counting detectors (PCDs) have the capability of discriminating the incident photons of different energy. The technique becomes more and more mature in nowadays. In this work, we explore the performance of a multi-energy CT imaging system with a PCD for liquid security inspection in material discrimination. We used a maximum-likelihood (ML) decomposition method with scatter correction based on a cross-energy response model (CERM) for PCDs so that to improve the accuracy of atomic number and electronic density imaging. Experimental study was carried to examine the effectiveness and robustness of the proposed system. Our results show that the concentration of different solutions in physical phantoms can be reconstructed accurately, which could improve the material identification compared to current available dual-energy liquid security inspection systems. The CERM-base decomposition and reconstruction method can be easily used to different applications such as medical diagnosis.

Research and realization implementation of monitor technology on illegal external link of classified computer

NASA Astrophysics Data System (ADS)

Zhang, Hong

2017-06-01

In recent years, with the continuous development and application of network technology, network security has gradually entered people's field of vision. The host computer network external network of violations is an important reason for the threat of network security. At present, most of the work units have a certain degree of attention to network security, has taken a lot of means and methods to prevent network security problems such as the physical isolation of the internal network, install the firewall at the exit. However, these measures and methods to improve network security are often not comply with the safety rules of human behavior damage. For example, the host to wireless Internet access and dual-network card to access the Internet, inadvertently formed a two-way network of external networks and computer connections [1]. As a result, it is possible to cause some important documents and confidentiality leak even in the the circumstances of user unaware completely. Secrecy Computer Violation Out-of-band monitoring technology can largely prevent the violation by monitoring the behavior of the offending connection. In this paper, we mainly research and discuss the technology of secret computer monitoring.

Understanding the Value of a Computer Emergency Response Capability for Nuclear Security

DOE Office of Scientific and Technical Information (OSTI.GOV)

Gasper, Peter Donald; Rodriguez, Julio Gallardo

The international nuclear community has a great understanding of the physical security needs relating to the prevention, detection, and response of malicious acts associated with nuclear facilities and radioactive material. International Atomic Energy Agency (IAEA) Nuclear Security Recommendations (INFCIRC_225_Rev 5) outlines specific guidelines and recommendations for implementing and maintaining an organization’s nuclear security posture. An important element for inclusion into supporting revision 5 is the establishment of a “Cyber Emergency Response Team (CERT)” focused on the international communities cybersecurity needs to maintain a comprehensive nuclear security posture. Cybersecurity and the importance of nuclear cybersecurity require that there be a specificmore » focus on developing an International Nuclear CERT (NS-CERT). States establishing contingency plans should have an understanding of the cyber threat landscape and the potential impacts to systems in place to protect and mitigate malicious activities. This paper will outline the necessary components, discuss the relationships needed within the international community, and outline a process by which the NS-CERT identifies, collects, processes, and reports critical information in order to establish situational awareness (SA) and support decision-making« less

Implementation of Strategies to Leverage Public and Private Resources for National Security Workforce Development

DOE Office of Scientific and Technical Information (OSTI.GOV)

None

2009-04-01

This report documents implementation strategies to leverage public and private resources for the development of an adequate national security workforce as part of the National Security Preparedness Project (NSPP), being performed under a U.S. Department of Energy (DOE)/National Nuclear Security Administration (NNSA) grant. There are numerous efforts across the United States to develop a properly skilled and trained national security workforce. Some of these efforts are the result of the leveraging of public and private dollars. As budget dollars decrease and the demand for a properly skilled and trained national security workforce increases, it will become even more important tomore » leverage every education and training dollar. This report details some of the efforts that have been implemented to leverage public and private resources, as well as implementation strategies to further leverage public and private resources.« less

45 CFR 164.318 - Compliance dates for the initial implementation of the security standards.

Code of Federal Regulations, 2011 CFR

2011-10-01

... 45 Public Welfare 1 2011-10-01 2011-10-01 false Compliance dates for the initial implementation of the security standards. 164.318 Section 164.318 Public Welfare DEPARTMENT OF HEALTH AND HUMAN SERVICES ADMINISTRATIVE DATA STANDARDS AND RELATED REQUIREMENTS SECURITY AND PRIVACY Security Standards for the Protection...

45 CFR 164.318 - Compliance dates for the initial implementation of the security standards.

Code of Federal Regulations, 2014 CFR

2014-10-01

... 45 Public Welfare 1 2014-10-01 2014-10-01 false Compliance dates for the initial implementation of the security standards. 164.318 Section 164.318 Public Welfare Department of Health and Human Services ADMINISTRATIVE DATA STANDARDS AND RELATED REQUIREMENTS SECURITY AND PRIVACY Security Standards for the Protection...

Analysis of Information Security Management Systems at 5 Domestic Hospitals with More than 500 Beds

PubMed Central

Park, Woo-Sung; Son, Seung-Sik; Lee, Mee-Jeong; Kim, Shin-Hyo; Choi, Eun-Mi; Bang, Ji-Eon; Kim, Yea-Eun; Kim, Ok-Nam

2010-01-01

Objectives The information security management systems (ISMS) of 5 hospitals with more than 500 beds were evaluated with regards to the level of information security, management, and physical and technical aspects so that we might make recommendations on information security and security countermeasures which meet both international standards and the needs of individual hospitals. Methods The ISMS check-list derived from international/domestic standards was distributed to each hospital to complete and the staff of each hospital was interviewed. Information Security Indicator and Information Security Values were used to estimate the present security levels and evaluate the application of each hospital's current system. Results With regard to the moderate clause of the ISMS, the hospitals were determined to be in compliance. The most vulnerable clause was asset management, in particular, information asset classification guidelines. The clauses of information security incident management and business continuity management were deemed necessary for the establishment of successful ISMS. Conclusions The level of current ISMS in the hospitals evaluated was determined to be insufficient. Establishment of adequate ISMS is necessary to ensure patient privacy and the safe use of medical records for various purposes. Implementation of ISMS which meet international standards with a long-term and comprehensive perspective is of prime importance. To reflect the requirements of the varied interests of medical staff, consumers, and institutions, the establishment of political support is essential to create suitable hospital ISMS. PMID:21818429

Firewall systems: the next generation

NASA Astrophysics Data System (ADS)

McGhie, Lynda L.

1996-01-01

To be competitive in today's globally connected marketplace, a company must ensure that their internal network security methodologies and supporting policies are current and reflect an overall understanding of today's technology and its resultant threats. Further, an integrated approach to information security should ensure that new ways of sharing information and doing business are accommodated; such as electronic commerce, high speed public broadband network services, and the federally sponsored National Information Infrastructure. There are many challenges, and success is determined by the establishment of a solid and firm baseline security architecture that accommodate today's external connectivity requirements, provides transitional solutions that integrate with evolving and dynamic technologies, and ultimately acknowledges both the strategic and tactical goals of an evolving network security architecture and firewall system. This paper explores the evolution of external network connectivity requirements, the associated challenges and the subsequent development and evolution of firewall security systems. It makes the assumption that a firewall is a set of integrated and interoperable components, coming together to form a `SYSTEM' and must be designed, implement and managed as such. A progressive firewall model will be utilized to illustrates the evolution of firewall systems from earlier models utilizing separate physical networks, to today's multi-component firewall systems enabling secure heterogeneous and multi-protocol interfaces.

78 FR 79017 - Zion Solutions, LLC; Zion Nuclear Power Station, Units 1 and 2; Exemption From Certain Physical...

Federal Register 2010, 2011, 2012, 2013, 2014

2013-12-27

...; Zion Nuclear Power Station, Units 1 and 2; Exemption From Certain Physical Security Requirements 1.0... the ZNPS Physical Security Plan (PSP) for the protection of the nuclear material while in transit to... the new physical security requirements in 10 CFR 73.55. The December 2, 2010, letter included...

Security and Privacy in Cyber-Physical Systems

DOE Office of Scientific and Technical Information (OSTI.GOV)

Fink, Glenn A.; Edgar, Thomas W.; Rice, Theora R.

As you have seen from the previous chapters, cyber-physical systems (CPS) are broadly used across technology and industrial domains. While these systems enable process optimization and efficiency and allow previously impossible functionality, security and privacy are key concerns for their design, development, and operation. CPS have been key components utilized in some of the highest publicized security breaches over the last decade. In this chapter, we will look over the CPS described in the previous chapters from a security perspective. In this chapter, we explain classical information and physical security fundamentals in the context of CPS and contextualize them acrossmore » application domains. We give examples where the interplay of functionality and diverse communication can introduce unexpected vulnerabilities and produce larger impacts. We will discuss how CPS security and privacy is inherently different from that of pure cyber or physical systems and what may be done to secure these systems, considering their emergent cyber-physical properties. Finally, we will discuss security and privacy implications of merging infrastructural and personal CPS. Our hope is to impart the knowledge of what CPS security and privacy are, why they are important, and explain existing processes and challenges.« less

The adoption of IT security standards in a healthcare environment.

PubMed

Gomes, Rui; Lapão, Luís Velez

2008-01-01

Security is a vital part of daily life to Hospitals that need to ensure that the information is adequately secured. In Portugal, more CIOs are seeking that their hospital IS departments are properly protecting information assets from security threats. It is imperative to take necessary measures to ensure risk management and business continuity. Security management certification provides just such a guarantee, increasing patient and partner confidence. This paper introduces one best practice for implementing four security controls in a hospital datacenter infrastructure (ISO27002), and describes the security assessment for implementing such controls.

Long-distance quantum communication with atomic ensembles and linear optics.

PubMed

Duan, L M; Lukin, M D; Cirac, J I; Zoller, P

2001-11-22

Quantum communication holds promise for absolutely secure transmission of secret messages and the faithful transfer of unknown quantum states. Photonic channels appear to be very attractive for the physical implementation of quantum communication. However, owing to losses and decoherence in the channel, the communication fidelity decreases exponentially with the channel length. Here we describe a scheme that allows the implementation of robust quantum communication over long lossy channels. The scheme involves laser manipulation of atomic ensembles, beam splitters, and single-photon detectors with moderate efficiencies, and is therefore compatible with current experimental technology. We show that the communication efficiency scales polynomially with the channel length, and hence the scheme should be operable over very long distances.

Implementation of an experimental fault-tolerant memory system

NASA Technical Reports Server (NTRS)

Carter, W. C.; Mccarthy, C. E.

1976-01-01

The experimental fault-tolerant memory system described in this paper has been designed to enable the modular addition of spares, to validate the theoretical fault-secure and self-testing properties of the translator/corrector, to provide a basis for experiments using the new testing and correction processes for recovery, and to determine the practicality of such systems. The hardware design and implementation are described, together with methods of fault insertion. The hardware/software interface, including a restricted single error correction/double error detection (SEC/DED) code, is specified. Procedures are carefully described which, (1) test for specified physical faults, (2) ensure that single error corrections are not miscorrections due to triple faults, and (3) enable recovery from double errors.

Strengthening the Security of ESA Ground Data Systems

NASA Astrophysics Data System (ADS)

Flentge, Felix; Eggleston, James; Garcia Mateos, Marc

2013-08-01

A common approach to address information security has been implemented in ESA's Mission Operations (MOI) Infrastructure during the last years. This paper reports on the specific challenges to the Data Systems domain within the MOI and how security can be properly managed with an Information Security Management System (ISMS) according to ISO 27001. Results of an initial security risk assessment are reported and the different types of security controls that are being implemented in order to reduce the risks are briefly described.

32 CFR 322.4 - Responsibilities.

Code of Federal Regulations, 2011 CFR

2011-07-01

... physical security requirements for the protection of personal information and ensure that such requirements... NATIONAL SECURITY AGENCY/CENTRAL SECURITY SERVICES PRIVACY ACT PROGRAM § 322.4 Responsibilities. (a) The... Associate Director for Human Resources Services or designee shall: (1) Establish the physical security...

A Hierarchical Security Architecture for Cyber-Physical Systems

DOE Office of Scientific and Technical Information (OSTI.GOV)

Quanyan Zhu; Tamer Basar

2011-08-01

Security of control systems is becoming a pivotal concern in critical national infrastructures such as the power grid and nuclear plants. In this paper, we adopt a hierarchical viewpoint to these security issues, addressing security concerns at each level and emphasizing a holistic cross-layer philosophy for developing security solutions. We propose a bottom-up framework that establishes a model from the physical and control levels to the supervisory level, incorporating concerns from network and communication levels. We show that the game-theoretical approach can yield cross-layer security strategy solutions to the cyber-physical systems.

10 CFR 73.28 - Security background checks for secure transfer of nuclear materials.

Code of Federal Regulations, 2010 CFR

2010-01-01

... 10 Energy 2 2010-01-01 2010-01-01 false Security background checks for secure transfer of nuclear materials. 73.28 Section 73.28 Energy NUCLEAR REGULATORY COMMISSION (CONTINUED) PHYSICAL PROTECTION OF PLANTS AND MATERIALS Physical Protection of Special Nuclear Material in Transit § 73.28 Security...

10 CFR 73.28 - Security background checks for secure transfer of nuclear materials.

Code of Federal Regulations, 2011 CFR

2011-01-01

... 10 Energy 2 2011-01-01 2011-01-01 false Security background checks for secure transfer of nuclear materials. 73.28 Section 73.28 Energy NUCLEAR REGULATORY COMMISSION (CONTINUED) PHYSICAL PROTECTION OF PLANTS AND MATERIALS Physical Protection of Special Nuclear Material in Transit § 73.28 Security...

10 CFR 73.28 - Security background checks for secure transfer of nuclear materials.

Code of Federal Regulations, 2012 CFR

2012-01-01

... 10 Energy 2 2012-01-01 2012-01-01 false Security background checks for secure transfer of nuclear materials. 73.28 Section 73.28 Energy NUCLEAR REGULATORY COMMISSION (CONTINUED) PHYSICAL PROTECTION OF PLANTS AND MATERIALS Physical Protection of Special Nuclear Material in Transit § 73.28 Security...

10 CFR 73.28 - Security background checks for secure transfer of nuclear materials.

Code of Federal Regulations, 2014 CFR

2014-01-01

... 10 Energy 2 2014-01-01 2014-01-01 false Security background checks for secure transfer of nuclear materials. 73.28 Section 73.28 Energy NUCLEAR REGULATORY COMMISSION (CONTINUED) PHYSICAL PROTECTION OF PLANTS AND MATERIALS Physical Protection of Special Nuclear Material in Transit § 73.28 Security...

10 CFR 73.28 - Security background checks for secure transfer of nuclear materials.

Code of Federal Regulations, 2013 CFR

2013-01-01

... 10 Energy 2 2013-01-01 2013-01-01 false Security background checks for secure transfer of nuclear materials. 73.28 Section 73.28 Energy NUCLEAR REGULATORY COMMISSION (CONTINUED) PHYSICAL PROTECTION OF PLANTS AND MATERIALS Physical Protection of Special Nuclear Material in Transit § 73.28 Security...

78 FR 5116 - NASA Information Security Protection

Federal Register 2010, 2011, 2012, 2013, 2014

2013-01-24

... 2700-AD61 NASA Information Security Protection AGENCY: National Aeronautics and Space Administration... implement the provisions of Executive Order (E.O.) 13526, Classified National Security Information, and... Information, that establishes the Agency's requirements for the proper implementation and management of a...

76 FR 34886 - General Services Administration Acquisition Regulation; Implementation of Information Technology...

Federal Register 2010, 2011, 2012, 2013, 2014

2011-06-15

... Acquisition Regulation; Implementation of Information Technology Security Provision AGENCY: Office of... information technology (IT) supplies, services and systems with security requirements. DATES: Effective Date... effective date that include information technology (IT) supplies, services and systems with security...

21 CFR 1301.75 - Physical security controls for practitioners.

Code of Federal Regulations, 2012 CFR

2012-04-01

... 21 Food and Drugs 9 2012-04-01 2012-04-01 false Physical security controls for practitioners. 1301.75 Section 1301.75 Food and Drugs DRUG ENFORCEMENT ADMINISTRATION, DEPARTMENT OF JUSTICE REGISTRATION....75 Physical security controls for practitioners. (a) Controlled substances listed in Schedule I shall...

21 CFR 1301.75 - Physical security controls for practitioners.

Code of Federal Regulations, 2010 CFR

2010-04-01

... 21 Food and Drugs 9 2010-04-01 2010-04-01 false Physical security controls for practitioners. 1301.75 Section 1301.75 Food and Drugs DRUG ENFORCEMENT ADMINISTRATION, DEPARTMENT OF JUSTICE REGISTRATION....75 Physical security controls for practitioners. (a) Controlled substances listed in Schedule I shall...

32 CFR 700.826 - Physical security.

Code of Federal Regulations, 2014 CFR

2014-07-01

... 32 National Defense 5 2014-07-01 2014-07-01 false Physical security. 700.826 Section 700.826 National Defense Department of Defense (Continued) DEPARTMENT OF THE NAVY UNITED STATES NAVY REGULATIONS... Commanding Officers in General § 700.826 Physical security. (a) The commanding officer shall take appropriate...

21 CFR 1301.75 - Physical security controls for practitioners.

Code of Federal Regulations, 2011 CFR

2011-04-01

... 21 Food and Drugs 9 2011-04-01 2011-04-01 false Physical security controls for practitioners. 1301.75 Section 1301.75 Food and Drugs DRUG ENFORCEMENT ADMINISTRATION, DEPARTMENT OF JUSTICE REGISTRATION....75 Physical security controls for practitioners. (a) Controlled substances listed in Schedule I shall...

32 CFR 700.826 - Physical security.

Code of Federal Regulations, 2013 CFR

2013-07-01

... 32 National Defense 5 2013-07-01 2013-07-01 false Physical security. 700.826 Section 700.826 National Defense Department of Defense (Continued) DEPARTMENT OF THE NAVY UNITED STATES NAVY REGULATIONS... Commanding Officers in General § 700.826 Physical security. (a) The commanding officer shall take appropriate...

21 CFR 1301.75 - Physical security controls for practitioners.

Code of Federal Regulations, 2013 CFR

2013-04-01

... 21 Food and Drugs 9 2013-04-01 2013-04-01 false Physical security controls for practitioners. 1301.75 Section 1301.75 Food and Drugs DRUG ENFORCEMENT ADMINISTRATION, DEPARTMENT OF JUSTICE REGISTRATION....75 Physical security controls for practitioners. (a) Controlled substances listed in Schedule I shall...

32 CFR 700.826 - Physical security.

Code of Federal Regulations, 2010 CFR

2010-07-01

... 32 National Defense 5 2010-07-01 2010-07-01 false Physical security. 700.826 Section 700.826 National Defense Department of Defense (Continued) DEPARTMENT OF THE NAVY UNITED STATES NAVY REGULATIONS... Commanding Officers in General § 700.826 Physical security. (a) The commanding officer shall take appropriate...

32 CFR 700.826 - Physical security.

Code of Federal Regulations, 2011 CFR

2011-07-01

... 32 National Defense 5 2011-07-01 2011-07-01 false Physical security. 700.826 Section 700.826 National Defense Department of Defense (Continued) DEPARTMENT OF THE NAVY UNITED STATES NAVY REGULATIONS... Commanding Officers in General § 700.826 Physical security. (a) The commanding officer shall take appropriate...

32 CFR 700.826 - Physical security.

Code of Federal Regulations, 2012 CFR

2012-07-01

... 32 National Defense 5 2012-07-01 2012-07-01 false Physical security. 700.826 Section 700.826 National Defense Department of Defense (Continued) DEPARTMENT OF THE NAVY UNITED STATES NAVY REGULATIONS... Commanding Officers in General § 700.826 Physical security. (a) The commanding officer shall take appropriate...

21 CFR 1301.75 - Physical security controls for practitioners.

Code of Federal Regulations, 2014 CFR

2014-04-01

... 21 Food and Drugs 9 2014-04-01 2014-04-01 false Physical security controls for practitioners. 1301.75 Section 1301.75 Food and Drugs DRUG ENFORCEMENT ADMINISTRATION, DEPARTMENT OF JUSTICE REGISTRATION....75 Physical security controls for practitioners. (a) Controlled substances listed in Schedule I shall...

Secure Multiparty AES

NASA Astrophysics Data System (ADS)

Damgård, Ivan; Keller, Marcel

We propose several variants of a secure multiparty computation protocol for AES encryption. The best variant requires 2200 + {{400}over{255}} expected elementary operations in expected 70 + {{20}over{255}} rounds to encrypt one 128-bit block with a 128-bit key. We implemented the variants using VIFF, a software framework for implementing secure multiparty computation (MPC). Tests with three players (passive security against at most one corrupted player) in a local network showed that one block can be encrypted in 2 seconds. We also argue that this result could be improved by an optimized implementation.

Implementing secure laptop-based testing in an undergraduate nursing program: a case study.

PubMed

Tao, Jinyuan; Lorentz, B Chris; Hawes, Stacey; Rugless, Fely; Preston, Janice

2012-07-01

This article presents the implementation of secure laptop-based testing in an undergraduate nursing program. Details on how to design, develop, implement, and secure tests are discussed. Laptop-based testing mode is also compared with the computer-laboratory-based testing model. Five elements of the laptop-based testing model are illustrated: (1) it simulates the national board examination, (2) security is achievable, (3) it is convenient for both instructors and students, (4) it provides students hands-on practice, (5) continuous technical support is the key.

Improvement of a Quantum Proxy Blind Signature Scheme

NASA Astrophysics Data System (ADS)

Zhang, Jia-Lei; Zhang, Jian-Zhong; Xie, Shu-Cui

2018-02-01

Improvement of a quantum proxy blind signature scheme is proposed in this paper. Six-qubit entangled state functions as quantum channel. In our scheme, a trust party Trent is introduced so as to avoid David's dishonest behavior. The receiver David verifies the signature with the help of Trent in our scheme. The scheme uses the physical characteristics of quantum mechanics to implement message blinding, delegation, signature and verification. Security analysis proves that our scheme has the properties of undeniability, unforgeability, anonymity and can resist some common attacks.

Improvement of a Quantum Proxy Blind Signature Scheme

NASA Astrophysics Data System (ADS)

Zhang, Jia-Lei; Zhang, Jian-Zhong; Xie, Shu-Cui

2018-06-01

Improvement of a quantum proxy blind signature scheme is proposed in this paper. Six-qubit entangled state functions as quantum channel. In our scheme, a trust party Trent is introduced so as to avoid David's dishonest behavior. The receiver David verifies the signature with the help of Trent in our scheme. The scheme uses the physical characteristics of quantum mechanics to implement message blinding, delegation, signature and verification. Security analysis proves that our scheme has the properties of undeniability, unforgeability, anonymity and can resist some common attacks.

MODIS. Volume 1: MODIS level 1A software baseline requirements

NASA Technical Reports Server (NTRS)

Masuoka, Edward; Fleig, Albert; Ardanuy, Philip; Goff, Thomas; Carpenter, Lloyd; Solomon, Carl; Storey, James

1994-01-01

This document describes the level 1A software requirements for the moderate resolution imaging spectroradiometer (MODIS) instrument. This includes internal and external requirements. Internal requirements include functional, operational, and data processing as well as performance, quality, safety, and security engineering requirements. External requirements include those imposed by data archive and distribution systems (DADS); scheduling, control, monitoring, and accounting (SCMA); product management (PM) system; MODIS log; and product generation system (PGS). Implementation constraints and requirements for adapting the software to the physical environment are also included.

DNA molecule stretching through thermo-electrophoresis and thermal convection in a heated converging-diverging microchannel.

PubMed

Hsieh, Shou-Shing; Chen, Jyun-Hong; Tsai, Cheng-Fung

2013-02-18

A novel DNA molecule stretching technique is developed and tested herein. Through a heated converging-diverging microchannel, thermal convection and thermophoresis induced by regional heating are shown to significantly elongate single DNA molecules; they are visualized via a confocal laser scanning microscopy. In addition, electrophoretic stretching is also implemented to examine the hybrid effect on the conformation and dynamics of single DNA molecules. The physical properties of the DNA molecules are secured via experimental measurements.

45 CFR 164.308 - Administrative safeguards.

Code of Federal Regulations, 2012 CFR

2012-10-01

...)(i) Standard: Security management process. Implement policies and procedures to prevent, detect... this subpart for the entity. (3)(i) Standard: Workforce security. Implement policies and procedures to...) Standard: Information access management. Implement policies and procedures for authorizing access to...

45 CFR 164.308 - Administrative safeguards.

Code of Federal Regulations, 2011 CFR

2011-10-01

...)(i) Standard: Security management process. Implement policies and procedures to prevent, detect... this subpart for the entity. (3)(i) Standard: Workforce security. Implement policies and procedures to...) Standard: Information access management. Implement policies and procedures for authorizing access to...

Bundle Security Protocol for ION

NASA Technical Reports Server (NTRS)

Burleigh, Scott C.; Birrane, Edward J.; Krupiarz, Christopher

2011-01-01

This software implements bundle authentication, conforming to the Delay-Tolerant Networking (DTN) Internet Draft on Bundle Security Protocol (BSP), for the Interplanetary Overlay Network (ION) implementation of DTN. This is the only implementation of BSP that is integrated with ION.

Cyber / Physical Security Vulnerability Assessment Integration

DOE Office of Scientific and Technical Information (OSTI.GOV)

MacDonald, Douglas G.; Simpkins, Bret E.

Abstract Both physical protection and cyber security domains offer solutions for the discovery of vulnerabilities through the use of various assessment processes and software tools. Each vulnerability assessment (VA) methodology provides the ability to identify and categorize vulnerabilities, and quantifies the risks within their own areas of expertise. Neither approach fully represents the true potential security risk to a site and/or a facility, nor comprehensively assesses the overall security posture. The technical approach to solving this problem was to identify methodologies and processes that blend the physical and cyber security assessments, and develop tools to accurately quantify the unaccounted formore » risk. SMEs from both the physical and the cyber security domains developed the blending methodologies, and cross trained each other on the various aspects of the physical and cyber security assessment processes. A local critical infrastructure entity volunteered to host a proof of concept physical/cyber security assessment, and the lessons learned have been leveraged by this effort. The four potential modes of attack an adversary can use in approaching a target are; Physical Only Attack, Cyber Only Attack, Physical Enabled Cyber Attack, and the Cyber Enabled Physical Attack. The Physical Only and the Cyber Only pathway analysis are two of the most widely analyzed attack modes. The pathway from an off-site location to the desired target location is dissected to ensure adversarial activity can be detected and neutralized by the protection strategy, prior to completion of a predefined task. This methodology typically explores a one way attack from the public space (or common area) inward towards the target. The Physical Enabled Cyber Attack and the Cyber Enabled Physical Attack are much more intricate. Both scenarios involve beginning in one domain to affect change in the other, then backing outward to take advantage of the reduced system effectiveness, before penetrating further into the defenses. The proper identification and assessment of the overlapping areas (and interaction between these areas) in the VA process is necessary to accurately assess the true risk.« less

Framework for Flexible Security in Group Communications

NASA Technical Reports Server (NTRS)

McDaniel, Patrick; Prakash, Atul

2006-01-01

The Antigone software system defines a framework for the flexible definition and implementation of security policies in group communication systems. Antigone does not dictate the available security policies, but provides high-level mechanisms for implementing them. A central element of the Antigone architecture is a suite of such mechanisms comprising micro-protocols that provide the basic services needed by secure groups.

Hope for successful implementation of psychosocial/psychiatric rehabilitation in the forensic mental health setting.

PubMed

Brown, Stephanie A; Lewis, Kent

2015-12-01

To explore staff perceptions of the successes and barriers to implementation of the psychosocial/psychiatric rehabilitation (PSR) model in the forensic mental health setting and identify staff supports needed for greater implementation. A qualitative descriptive design was used and staff focus group data was analyzed using the constant comparative method. All aspects of PSR are being implemented in the forensic setting. Barriers limiting comprehensive implementation include hospital processes and functions, legal components, client clinical presentation, staff attributes and interactions, and lack of resources. To foster greater implementation, employees require support to improve interprofessional interactions and acquire additional resources and education. Strengthening existing successes and addressing barriers identified will foster greater PSR implementation in the forensic setting. Adjusting the physical environment, streamlining documentation, shifting focus from security to rehabilitation goals, and adapting PSR principles to various levels of illness acuity and stages of treatment would enhance PSR implementation. A management focus on improving staff morale, self-care, peer support, team cohesion, and communication would limit burnout and increase successful implementation of PSR. Additional educational opportunities and ongoing training are suggested to support a unified understanding and sustained approach to PSR implementation in the forensic setting. (c) 2015 APA, all rights reserved).

Digital Signal Processing Methods for Safety Systems Employed in Nuclear Power Industry

NASA Astrophysics Data System (ADS)

Popescu, George

Some of the major safety concerns in the nuclear power industry focus on the readiness of nuclear power plant safety systems to respond to an abnormal event, the security of special nuclear materials in used nuclear fuels, and the need for physical security to protect personnel and reactor safety systems from an act of terror. Routine maintenance and tests of all nuclear reactor safety systems are performed on a regular basis to confirm the ability of these systems to operate as expected. However, these tests do not determine the reliability of these safety systems and whether the systems will perform for the duration of an accident and whether they will perform their tasks without failure after being engaged. This research has investigated the progression of spindle asynchronous error motion determined from spindle accelerations to predict bearings failure onset. This method could be applied to coolant pumps that are essential components of emergency core cooling systems at all nuclear power plants. Recent security upgrades mandated by the Nuclear Regulatory Commission and the Department of Homeland Security have resulted in implementation of multiple physical security barriers around all of the commercial and research nuclear reactors in the United States. A second part of this research attempts to address an increased concern about illegal trafficking of Special Nuclear Materials (SNM). This research describes a multi element scintillation detector system designed for non - invasive (passive) gamma ray surveillance for concealed SNM that may be within an area or sealed in a package, vehicle or shipping container. Detection capabilities of the system were greatly enhanced through digital signal processing, which allows the combination of two very powerful techniques: 1) Compton Suppression (CS) and 2) Pulse Shape Discrimination (PSD) with less reliance on complicated analog instrumentation.

Design of Secure ECG-Based Biometric Authentication in Body Area Sensor Networks

PubMed Central

Peter, Steffen; Pratap Reddy, Bhanu; Momtaz, Farshad; Givargis, Tony

2016-01-01

Body area sensor networks (BANs) utilize wireless communicating sensor nodes attached to a human body for convenience, safety, and health applications. Physiological characteristics of the body, such as the heart rate or Electrocardiogram (ECG) signals, are promising means to simplify the setup process and to improve security of BANs. This paper describes the design and implementation steps required to realize an ECG-based authentication protocol to identify sensor nodes attached to the same human body. Therefore, the first part of the paper addresses the design of a body-area sensor system, including the hardware setup, analogue and digital signal processing, and required ECG feature detection techniques. A model-based design flow is applied, and strengths and limitations of each design step are discussed. Real-world measured data originating from the implemented sensor system are then used to set up and parametrize a novel physiological authentication protocol for BANs. The authentication protocol utilizes statistical properties of expected and detected deviations to limit the number of false positive and false negative authentication attempts. The result of the described holistic design effort is the first practical implementation of biometric authentication in BANs that reflects timing and data uncertainties in the physical and cyber parts of the system. PMID:27110785

Design of Secure ECG-Based Biometric Authentication in Body Area Sensor Networks.

PubMed

Peter, Steffen; Reddy, Bhanu Pratap; Momtaz, Farshad; Givargis, Tony

2016-04-22

Body area sensor networks (BANs) utilize wireless communicating sensor nodes attached to a human body for convenience, safety, and health applications. Physiological characteristics of the body, such as the heart rate or Electrocardiogram (ECG) signals, are promising means to simplify the setup process and to improve security of BANs. This paper describes the design and implementation steps required to realize an ECG-based authentication protocol to identify sensor nodes attached to the same human body. Therefore, the first part of the paper addresses the design of a body-area sensor system, including the hardware setup, analogue and digital signal processing, and required ECG feature detection techniques. A model-based design flow is applied, and strengths and limitations of each design step are discussed. Real-world measured data originating from the implemented sensor system are then used to set up and parametrize a novel physiological authentication protocol for BANs. The authentication protocol utilizes statistical properties of expected and detected deviations to limit the number of false positive and false negative authentication attempts. The result of the described holistic design effort is the first practical implementation of biometric authentication in BANs that reflects timing and data uncertainties in the physical and cyber parts of the system.

National Security Technology Incubation Strategic Plan

DOE Office of Scientific and Technical Information (OSTI.GOV)

None, None

This strategic plan contains information on the vision, mission, business and technology environment, goals, objectives, and incubation process of the National Security Technology Incubation Program (NSTI) at Arrowhead Center. The development of the NSTI is a key goal of the National Security Preparedness Project (NSPP). Objectives to achieve this goal include developing incubator plans (strategic, business, action, and operations), creating an incubator environment, creating a support and mentor network for companies in the incubator program, attracting security technology businesses to the region, encouraging existing business to expand, initiating business start-ups, evaluating products and processes of the incubator program, and achievingmore » sustainability of the incubator program. With the events of 9/11, the global community faces ever increasing and emerging threats from hostile groups determined to rule by terror. According to the National Nuclear Security Administration (NNSA) Strategic Plan, the United States must be able to quickly respond and adapt to unanticipated situations as they relate to protection of our homeland and national security. Technology plays a key role in a strong national security position, and the private business community, along with the national laboratories, academia, defense and homeland security organizations, provide this technology. Fostering innovative ideas, translated into relevant technologies answering the needs of NNSA, is the purpose of the NSTI. Arrowhead Center of New Mexico State University is the operator and manager of the NSTI. To develop the NSTI, Arrowhead Center must meet the planning, development, execution, evaluation, and sustainability activities for the program and identify and incubate new technologies to assist the NNSA in meeting its mission and goals. Technology alone does not give a competitive advantage to the country, but the creativity and speed with which it is employed does. For a company to succeed, it must have sustainable competitive advantages in seven key areas: geography, products and businesses, distribution, sales and service culture, efficiency, brand, and most important, people. The four strategic goals of the plan are to: 1. Identify and recruit small businesses with technology applications for national security. 2. Design and implement a national security incubator program that provides incubator services and physical space for the targeted businesses. 3. Provide business assistance and technical leadership to NSTI clients to assist in bringing their products to market. 4. Construct a new multi-tenant facility with dedicated physical space for businesses with technology applications for national security.« less

Implementation of QoSS (Quality-of-Security Service) for NoC-Based SoC Protection

NASA Astrophysics Data System (ADS)

Sepúlveda, Johanna; Pires, Ricardo; Strum, Marius; Chau, Wang Jiang

Many of the current electronic systems embedded in a SoC (System-on-Chip) are used to capture, store, manipulate and access critical data, as well as to perform other key functions. In such a scenario, security is considered as an important issue. The Network-on-chip (NoC), as the foreseen communication structure of next-generation SoC devices, can be used to efficiently incorporate security. Our work proposes the implementation of QoSS (Quality of Security Service) to overcome present SoC vulnerabilities. QoSS is a novel concept for data protection that introduces security as a dimension of QoS. In this paper, we present the implementation of two security services (access control and authentication), that may be configured to assume one from several possible levels, the implementation of a technique to avoid denial-of-service (DoS) attacks, evaluate their effectiveness and estimate their impact on NoC performance.

Security breaches: tips for assessing and limiting your risks.

PubMed

Coons, Leeanne R

2011-01-01

As part of their compliance planning, medical practices should undergo a risk assessment to determine any vulnerability within the practice relative to security breaches. Practices should also implement safeguards to limit their risks. Such safeguards include facility access controls, information and electronic media management, use of business associate agreements, and education and enforcement. Implementation of specific policies and procedures to address security incidents is another critical step that medical practices should take as part of their security incident prevention plan. Medical practices should not only develop policies and procedures to prevent, detect, contain, and correct security violations, but should make sure that such policies and procedures are actually implemented in their everyday operations.

Implementing the global health security agenda: lessons from global health and security programs.

PubMed

Paranjape, Suman M; Franz, David R

2015-01-01

The Global Health Security Agenda (GHSA) describes a vision for a world that is safe and secure from infectious disease threats; it underscores the importance of developing the international capacity to prevent, detect, and respond to pandemic agents. In February 2014, the United States committed to support the GHSA by expanding and intensifying ongoing efforts across the US government. Implementing these goals will require interagency coordination and harmonization of diverse health security elements. Lessons learned from the Global Health Initiative (GHI), the President's Emergency Program for AIDS Relief (PEPFAR), and the Cooperative Threat Reduction (CTR) program underscore that centralized political, technical, and fiscal authority will be key to developing robust, sustainable, and integrated global health security efforts across the US government. In this article, we review the strengths and challenges of GHI, PEPFAR, and CTR and develop recommendations for implementing a unified US global health security program.

Video calls from lay bystanders to dispatch centers - risk assessment of information security.

PubMed

Bolle, Stein R; Hasvold, Per; Henriksen, Eva

2011-09-30

Video calls from mobile phones can improve communication during medical emergencies. Lay bystanders can be instructed and supervised by health professionals at Emergency Medical Communication Centers. Before implementation of video mobile calls in emergencies, issues of information security should be addressed. Information security was assessed for risk, based on the information security standard ISO/IEC 27005:2008. A multi-professional team used structured brainstorming to find threats to the information security aspects confidentiality, quality, integrity, and availability. Twenty security threats of different risk levels were identified and analyzed. Solutions were proposed to reduce the risk level. Given proper implementation, we found no risks to information security that would advocate against the use of video calls between lay bystanders and Emergency Medical Communication Centers. The identified threats should be used as input to formal requirements when planning and implementing video calls from mobile phones for these call centers.

Video calls from lay bystanders to dispatch centers - risk assessment of information security

PubMed Central

2011-01-01

Background Video calls from mobile phones can improve communication during medical emergencies. Lay bystanders can be instructed and supervised by health professionals at Emergency Medical Communication Centers. Before implementation of video mobile calls in emergencies, issues of information security should be addressed. Methods Information security was assessed for risk, based on the information security standard ISO/IEC 27005:2008. A multi-professional team used structured brainstorming to find threats to the information security aspects confidentiality, quality, integrity, and availability. Results Twenty security threats of different risk levels were identified and analyzed. Solutions were proposed to reduce the risk level. Conclusions Given proper implementation, we found no risks to information security that would advocate against the use of video calls between lay bystanders and Emergency Medical Communication Centers. The identified threats should be used as input to formal requirements when planning and implementing video calls from mobile phones for these call centers. PMID:21958387

Information Security Management (ISM)

NASA Astrophysics Data System (ADS)

Šalgovičová, Jarmila; Prajová, Vanessa

2012-12-01

Currently, all organizations have to tackle the issue of information security. The paper deals with various aspects of Information Security Management (ISM), including procedures, processes, organizational structures, policies and control processes. Introduction of Information Security Management should be a strategic decision. The concept and implementation of Information Security Management in an organization are determined by the corporate needs and objectives, security requirements, the processes deployed as well as the size and structure of the organization. The implementation of ISM should be carried out to the extent consistent with the needs of the organization.

Views of policy makers and health promotion professionals on factors facilitating implementation and maintenance of interventions and policies promoting physical activity and healthy eating: results of the DEDIPAC project.

PubMed

Muellmann, Saskia; Steenbock, Berit; De Cocker, Katrien; De Craemer, Marieke; Hayes, Catherine; O'Shea, Miriam P; Horodyska, Karolina; Bell, Justyna; Luszczynska, Aleksandra; Roos, Gun; Langøien, Lars Jørun; Rugseth, Gro; Terragni, Laura; De Bourdeaudhuij, Ilse; Brug, Johannes; Pischke, Claudia R

2017-12-06

The uptake, implementation, and maintenance of effective interventions promoting physical activity (PA) and a healthy diet and the implementation of policies targeting these behaviors are processes not well understood. We aimed to gain a better understanding of what health promotion professionals and policy makers think are important factors facilitating adoption, implementation, and maintenance of multi-level interventions and policies promoting healthy eating and PA in Belgium, Germany, Ireland, Norway, and Poland. Six interventions and six policies were identified based on pre-defined criteria. Forty semi-structured interviews were conducted with stakeholders from various sectors to elicit information on factors impacting adoption, implementation, and maintenance of these interventions and policies. All interview transcripts were coded in NVivo, using a common categorization matrix. Coding in the respective countries was done by one researcher and validated by a second researcher. Active involvement of relevant stakeholders and good communication between coordinating organizations were described as important factors contributing to successful adoption and implementation of both interventions and policies. Additional facilitating factors included sufficient training of staff and tailoring of materials to match needs of various target groups. The respondents indicated that maintenance of implemented interventions/policies depended on whether they were embedded in existing or newly created organizational structures in different settings and whether continued funding was secured. Despite considerable heterogeneity of interventions and health policies in the five countries, stakeholders across these countries identify similar factors facilitating adoption, implementation, and maintenance of these interventions and policies.

The Design Process of Physical Security as Applied to a U.S. Border Port of Entry

DOE Office of Scientific and Technical Information (OSTI.GOV)

Wagner, G.G.

1999-02-22

This paper details the application of a standard physical security system design process to a US Border Port of Entry (PoE) for vehicle entry/exit. The physical security design methodology is described as well as the physical security similarities to facilities currently at a US Border PoE for vehicles. The physical security design process description includes the various elements that make up the methodologies well as the considerations that must be taken into account when dealing with system integration of those elements. The distinctions between preventing unlawful entry/exit of illegal contraband and personnel are described. The potential to enhance the functionsmore » of drug/contraband detection in the Pre-Primary Inspection area through the application of emerging technologies are also addressed.« less

Space weather effects on communications

NASA Astrophysics Data System (ADS)

Lanzerotti, Louis J.

In the 150 years since the advent of the first electrical communication system - the electrical telegraph - the diversity of communications technologies that are embedded within space-affected environments have vastly increased. The increasing sophistication of these communications technologies, and how their installation and operations may relate to the environments in which they are embedded, requires ever more sophisticated understanding of natural physical phenomena. At the same time, the business environment for most present-day communications technologies that are affected by space phenomena is very dynamic. The commercial and national security deployment and use of these technologies do not wait for optimum knowledge of possible environmental effects to be acquired before new technological embodiments are created, implemented, and marketed. Indeed, those companies that might foolishly seek perfectionist understanding of natural effects can be left behind by the marketplace. A well-considered balance is needed between seeking ever deeper understanding of physical phenomena and implementing `engineering' solutions to current crises. The research community must try to understand, and operate in, this dynamic environment.

77 FR 55864 - Applications and Amendments to Facility Operating Licenses and Combined Licenses Involving...

Federal Register 2010, 2011, 2012, 2013, 2014

2012-09-11

.... ML111940200), which approved the RBS Cyber Security Plan and associated implementation milestone schedule. The Cyber Security Plan Implementation Schedule contained in the licensee's letter dated April 4, 2011... consequences of an accident previously evaluated? Response: No. The proposed change to the Cyber Security Plan...

77 FR 45354 - Notification of Single Source Cooperative Agreement Award for Project Hope

Federal Register 2010, 2011, 2012, 2013, 2014

2012-07-31

... Support of National Health Security Strategy (2009) and Implementation Plan (2012) and Homeland Security... Directive-21 (2007) and the National Health Security Strategy (2009) and Implementation Plan (2012). In the... of a Health Affairs thematic issue that will identify, explore and propose policy options for...

75 FR 10633 - Privacy Act of 1974: Implementation of Exemptions; Department of Homeland Security United States...

Federal Register 2010, 2011, 2012, 2013, 2014

2010-03-09

... of 1974: Implementation of Exemptions; Department of Homeland Security United States Immigration and Customs Enforcement-- 011 Immigration and Enforcement Operational Records System of Records AGENCY... rule to amend its regulations to exempt portions of a Department of Homeland Security/U.S. Immigration...

17 CFR 8.02 - Implementing exchange rules.

Code of Federal Regulations, 2010 CFR

2010-04-01

... 17 Commodity and Securities Exchanges 1 2010-04-01 2010-04-01 false Implementing exchange rules. 8.02 Section 8.02 Commodity and Securities Exchanges COMMODITY FUTURES TRADING COMMISSION EXCHANGE PROCEDURES FOR DISCIPLINARY, SUMMARY, AND MEMBERSHIP DENIAL ACTIONS General Provisions § 8.02 Implementing...

Rotting from Within: American Education and National Security

DTIC Science & Technology

2011-03-04

Service, Training, Obesity, Health, Physical Fitness, Economic, Security, Training Education, High School, Pre-School, Teachers, Leaders, Military...Accessions, Citizenship, Quality, Selfless Service, Training, Obesity, Health, Physical Fitness, Economic, Security, Training Education, High School...subject areas 4 such as the arts and physical fitness. This emphasis on core-courses was mostly adhered to by America‘s diverse school systems

Theoretical and experimental study of a new algorithm for factoring numbers

NASA Astrophysics Data System (ADS)

Tamma, Vincenzo

The security of codes, for example in credit card and government information, relies on the fact that the factorization of a large integer N is a rather costly process on a classical digital computer. Such a security is endangered by Shor's algorithm which employs entangled quantum systems to find, with a polynomial number of resources, the period of a function which is connected with the factors of N. We can surely expect a possible future realization of such a method for large numbers, but so far the period of Shor's function has been only computed for the number 15. Inspired by Shor's idea, our work aims to methods of factorization based on the periodicity measurement of a given continuous periodic "factoring function" which is physically implementable using an analogue computer. In particular, we have focused on both the theoretical and the experimental analysis of Gauss sums with continuous arguments leading to a new factorization algorithm. The procedure allows, for the first time, to factor several numbers by measuring the periodicity of Gauss sums performing first-order "factoring" interfer ence processes. We experimentally implemented this idea by exploiting polychromatic optical interference in the visible range with a multi-path interferometer, and achieved the factorization of seven digit numbers. The physical principle behind this "factoring" interference procedure can be potentially exploited also on entangled systems, as multi-photon entangled states, in order to achieve a polynomial scaling in the number of resources.

Network-Centric Quantum Communications

NASA Astrophysics Data System (ADS)

Hughes, Richard

2014-03-01

Single-photon quantum communications (QC) offers ``future-proof'' cryptographic security rooted in the laws of physics. Today's quantum-secured communications cannot be compromised by unanticipated future technological advances. But to date, QC has only existed in point-to-point instantiations that have limited ability to address the cyber security challenges of our increasingly networked world. In my talk I will describe a fundamentally new paradigm of network-centric quantum communications (NQC) that leverages the network to bring scalable, QC-based security to user groups that may have no direct user-to-user QC connectivity. With QC links only between each of N users and a trusted network node, NQC brings quantum security to N2 user pairs, and to multi-user groups. I will describe a novel integrated photonics quantum smartcard (``QKarD'') and its operation in a multi-node NQC test bed. The QKarDs are used to implement the quantum cryptographic protocols of quantum identification, quantum key distribution and quantum secret splitting. I will explain how these cryptographic primitives are used to provide key management for encryption, authentication, and non-repudiation for user-to-user communications. My talk will conclude with a description of a recent demonstration that QC can meet both the security and quality-of-service (latency) requirements for electric grid control commands and data. These requirements cannot be met simultaneously with present-day cryptography.

45 CFR 1182.15 - Institute responsibility for maintaining adequate technical, physical, and security safeguards to...

Code of Federal Regulations, 2010 CFR

2010-10-01

... record systems. These security safeguards shall apply to all systems in which identifiable personal data... data and automated systems shall be adequately trained in the security and privacy of personal data. (4... technical, physical, and security safeguards to prevent unauthorized disclosure or destruction of manual and...

45 CFR 2508.10 - Who has the responsibility for maintaining adequate technical, physical, and security safeguards...

Code of Federal Regulations, 2010 CFR

2010-10-01

... record systems. These security safeguards shall apply to all systems in which identifiable personal data... the security and privacy of such records. (7) The disposal and destruction of records within a system... adequate technical, physical, and security safeguards to prevent unauthorized disclosure or destruction of...

45 CFR 1159.15 - Who has the responsibility for maintaining adequate technical, physical, and security safeguards...

Code of Federal Regulations, 2010 CFR

2010-10-01

... disclosure or destruction of manual and automatic record systems. These security safeguards shall apply to... use of records contained in a system of records are adequately trained to protect the security and... adequate technical, physical, and security safeguards to prevent unauthorized disclosure or destruction of...

17 CFR 240.31 - Section 31 transaction fees.

Code of Federal Regulations, 2010 CFR

2010-04-01

... of a security future settled by physical delivery) or covered round turn transaction that a covered... resulting from the maturation of a security future settled by physical delivery; and (iv) The trade date.... (6) Covered sale means a sale of a security, other than an exempt sale or a sale of a security future...

The design of the automated control system for warehouse equipment under radio-electronic manufacturing

NASA Astrophysics Data System (ADS)

Kapulin, D. V.; Chemidov, I. V.; Kazantsev, M. A.

2017-01-01

In the paper, the aspects of design, development and implementation of the automated control system for warehousing under the manufacturing process of the radio-electronic enterprise JSC «Radiosvyaz» are discussed. The architecture of the automated control system for warehousing proposed in the paper consists of a server which is connected to the physically separated information networks: the network with a database server, which stores information about the orders for picking, and the network with the automated storage and retrieval system. This principle allows implementing the requirements for differentiation of access, ensuring the information safety and security requirements. Also, the efficiency of the developed automated solutions in terms of optimizing the warehouse’s logistic characteristics is researched.

Wireless physical layer security

NASA Astrophysics Data System (ADS)

Poor, H. Vincent; Schaefer, Rafael F.

2017-01-01

Security in wireless networks has traditionally been considered to be an issue to be addressed separately from the physical radio transmission aspects of wireless systems. However, with the emergence of new networking architectures that are not amenable to traditional methods of secure communication such as data encryption, there has been an increase in interest in the potential of the physical properties of the radio channel itself to provide communications security. Information theory provides a natural framework for the study of this issue, and there has been considerable recent research devoted to using this framework to develop a greater understanding of the fundamental ability of the so-called physical layer to provide security in wireless networks. Moreover, this approach is also suggestive in many cases of coding techniques that can approach fundamental limits in practice and of techniques for other security tasks such as authentication. This paper provides an overview of these developments.

Wireless physical layer security.

PubMed

Poor, H Vincent; Schaefer, Rafael F

2017-01-03

Security in wireless networks has traditionally been considered to be an issue to be addressed separately from the physical radio transmission aspects of wireless systems. However, with the emergence of new networking architectures that are not amenable to traditional methods of secure communication such as data encryption, there has been an increase in interest in the potential of the physical properties of the radio channel itself to provide communications security. Information theory provides a natural framework for the study of this issue, and there has been considerable recent research devoted to using this framework to develop a greater understanding of the fundamental ability of the so-called physical layer to provide security in wireless networks. Moreover, this approach is also suggestive in many cases of coding techniques that can approach fundamental limits in practice and of techniques for other security tasks such as authentication. This paper provides an overview of these developments.

Wireless physical layer security

PubMed Central

Schaefer, Rafael F.

2017-01-01

Security in wireless networks has traditionally been considered to be an issue to be addressed separately from the physical radio transmission aspects of wireless systems. However, with the emergence of new networking architectures that are not amenable to traditional methods of secure communication such as data encryption, there has been an increase in interest in the potential of the physical properties of the radio channel itself to provide communications security. Information theory provides a natural framework for the study of this issue, and there has been considerable recent research devoted to using this framework to develop a greater understanding of the fundamental ability of the so-called physical layer to provide security in wireless networks. Moreover, this approach is also suggestive in many cases of coding techniques that can approach fundamental limits in practice and of techniques for other security tasks such as authentication. This paper provides an overview of these developments. PMID:28028211

Twenty Seven Years of Quantum Cryptography!

NASA Astrophysics Data System (ADS)

Hughes, Richard

2011-03-01

One of the fundamental goals of cryptographic research is to minimize the assumptions underlying the protocols that enable secure communications between pairs or groups of users. In 1984, building on earlier research by Stephen Wiesner, Charles Bennett and Gilles Brassard showed how quantum physics could be harnessed to provide information-theoretic security for protocols such as the distribution of cryptographic keys, which enables two parties to secure their conventional communications. Bennett and Brassard and colleagues performed a proof-of-principle quantum key distribution (QKD) experiment with single-photon quantum state transmission over a 32-cm air path in 1991. This seminal experiment led other researchers to explore QKD in optical fibers and over line-of-sight outdoor atmospheric paths (``free-space''), resulting in dramatic increases in range, bit rate and security. These advances have been enabled by improvements in sources and single-photon detectors. Also in 1991 Artur Ekert showed how the security of QKD could be related to quantum entanglement. This insight led to a deeper understanding and proof of QKD security with practical sources and detectors in the presence of transmission loss and channel noise. Today, QKD has been implemented over ranges much greater than 100km in both fiber and free-space, multi-node network testbeds have been demonstrated, and satellite-based QKD is under study in several countries. ``Quantum hacking'' researchers have shown the importance of extending security considerations to the classical devices that produce and detect the photon quantum states. New quantum cryptographic protocols such as secure identification have been proposed, and others such as quantum secret splitting have been demonstrated. It is now possible to envision quantum cryptography providing a more secure alternative to present-day cryptographic methods for many secure communications functions. My talk will survey these remarkable developments.

45 CFR 164.318 - Compliance dates for the initial implementation of the security standards.

Code of Federal Regulations, 2013 CFR

2013-10-01

... of Electronic Protected Health Information § 164.318 Compliance dates for the initial implementation of the security standards. (a) Health plan. (1) A health plan that is not a small health plan must... the security standards. 164.318 Section 164.318 Public Welfare DEPARTMENT OF HEALTH AND HUMAN SERVICES...

45 CFR 164.318 - Compliance dates for the initial implementation of the security standards.

Code of Federal Regulations, 2012 CFR

2012-10-01

... of Electronic Protected Health Information § 164.318 Compliance dates for the initial implementation of the security standards. (a) Health plan. (1) A health plan that is not a small health plan must... the security standards. 164.318 Section 164.318 Public Welfare DEPARTMENT OF HEALTH AND HUMAN SERVICES...

75 FR 7979 - Privacy Act of 1974: Implementation of Exemptions; Department of Homeland Security/ALL-027 The...

Federal Register 2010, 2011, 2012, 2013, 2014

2010-02-23

... privacy issues please contact: Mary Ellen Callahan (703-235-0780), Chief Privacy Officer, Privacy Office...] Privacy Act of 1974: Implementation of Exemptions; Department of Homeland Security/ALL-027 The History of the Department of Homeland Security System of Records AGENCY: Privacy Office, DHS. ACTION: Notice of...

75 FR 51490 - Notice; Applications and Amendments to Facility Operating Licenses Involving Proposed No...

Federal Register 2010, 2011, 2012, 2013, 2014

2010-08-20

...). The proposed amendment would approve the cyber security plan and implementation schedule, and revise... maintain in effect all provisions of the NRC-approved cyber security plan. Basis for proposed no... [facility operating license] to implement and maintain a Cyber Security Plan as part of Energy Northwest's...

76 FR 20377 - Applications and Amendments to Facility Operating Licenses Involving Proposed No Significant...

Federal Register 2010, 2011, 2012, 2013, 2014

2011-04-12

... amendment requests approval of the Exelon Cyber Security Plan, provides an Implementation Schedule, and adds... require Exelon to fully implement and maintain in effect all provisions of the approved Cyber Security..., Revision 6, ``Cyber Security Plan for Nuclear Power Reactors.'' Basis for proposed no significant hazards...

32 CFR 321.14 - DSS implementation policies.

Code of Federal Regulations, 2014 CFR

2014-07-01

...) PRIVACY PROGRAM DEFENSE SECURITY SERVICE PRIVACY PROGRAM § 321.14 DSS implementation policies. (a) General... matters of particular concern to the Defense Security Service. (b) Privacy Act rules application. Any... 32 National Defense 2 2014-07-01 2014-07-01 false DSS implementation policies. 321.14 Section 321...

32 CFR 321.14 - DSS implementation policies.

Code of Federal Regulations, 2013 CFR

2013-07-01

...) PRIVACY PROGRAM DEFENSE SECURITY SERVICE PRIVACY PROGRAM § 321.14 DSS implementation policies. (a) General... matters of particular concern to the Defense Security Service. (b) Privacy Act rules application. Any... 32 National Defense 2 2013-07-01 2013-07-01 false DSS implementation policies. 321.14 Section 321...

32 CFR 321.14 - DSS implementation policies.

Code of Federal Regulations, 2012 CFR

2012-07-01

...) PRIVACY PROGRAM DEFENSE SECURITY SERVICE PRIVACY PROGRAM § 321.14 DSS implementation policies. (a) General... matters of particular concern to the Defense Security Service. (b) Privacy Act rules application. Any... 32 National Defense 2 2012-07-01 2012-07-01 false DSS implementation policies. 321.14 Section 321...

A Security Monitoring Framework For Virtualization Based HEP Infrastructures

NASA Astrophysics Data System (ADS)

Gomez Ramirez, A.; Martinez Pedreira, M.; Grigoras, C.; Betev, L.; Lara, C.; Kebschull, U.; ALICE Collaboration

2017-10-01

High Energy Physics (HEP) distributed computing infrastructures require automatic tools to monitor, analyze and react to potential security incidents. These tools should collect and inspect data such as resource consumption, logs and sequence of system calls for detecting anomalies that indicate the presence of a malicious agent. They should also be able to perform automated reactions to attacks without administrator intervention. We describe a novel framework that accomplishes these requirements, with a proof of concept implementation for the ALICE experiment at CERN. We show how we achieve a fully virtualized environment that improves the security by isolating services and Jobs without a significant performance impact. We also describe a collected dataset for Machine Learning based Intrusion Prevention and Detection Systems on Grid computing. This dataset is composed of resource consumption measurements (such as CPU, RAM and network traffic), logfiles from operating system services, and system call data collected from production Jobs running in an ALICE Grid test site and a big set of malware samples. This malware set was collected from security research sites. Based on this dataset, we will proceed to develop Machine Learning algorithms able to detect malicious Jobs.

DNA-Cryptography-Based Obfuscated Systolic Finite Field Multiplier for Secure Cryptosystem in Smart Grid

NASA Astrophysics Data System (ADS)

Chen, Shaobo; Chen, Pingxiuqi; Shao, Qiliang; Basha Shaik, Nazeem; Xie, Jiafeng

2017-05-01

The elliptic curve cryptography (ECC) provides much stronger security per bits compared to the traditional cryptosystem, and hence it is an ideal role in secure communication in smart grid. On the other side, secure implementation of finite field multiplication over GF(2 m ) is considered as the bottle neck of ECC. In this paper, we present a novel obfuscation strategy for secure implementation of systolic field multiplier for ECC in smart grid. First, for the first time, we propose a novel obfuscation technique to derive a novel obfuscated systolic finite field multiplier for ECC implementation. Then, we employ the DNA cryptography coding strategy to obfuscate the field multiplier further. Finally, we obtain the area-time-power complexity of the proposed field multiplier to confirm the efficiency of the proposed design. The proposed design is highly obfuscated with low overhead, suitable for secure cryptosystem in smart grid.

A Fully Immersive Set-Up for Remote Interaction and Neurorehabilitation Based on Virtual Body Ownership

PubMed Central

Perez-Marcos, Daniel; Solazzi, Massimiliano; Steptoe, William; Oyekoya, Oyewole; Frisoli, Antonio; Weyrich, Tim; Steed, Anthony; Tecchia, Franco; Slater, Mel; Sanchez-Vives, Maria V.

2012-01-01

Although telerehabilitation systems represent one of the most technologically appealing clinical solutions for the immediate future, they still present limitations that prevent their standardization. Here we propose an integrated approach that includes three key and novel factors: (a) fully immersive virtual environments, including virtual body representation and ownership; (b) multimodal interaction with remote people and virtual objects including haptic interaction; and (c) a physical representation of the patient at the hospital through embodiment agents (e.g., as a physical robot). The importance of secure and rapid communication between the nodes is also stressed and an example implemented solution is described. Finally, we discuss the proposed approach with reference to the existing literature and systems. PMID:22787454

A security architecture for health information networks.

PubMed

Kailar, Rajashekar; Muralidhar, Vinod

2007-10-11

Health information network security needs to balance exacting security controls with practicality, and ease of implementation in today's healthcare enterprise. Recent work on 'nationwide health information network' architectures has sought to share highly confidential data over insecure networks such as the Internet. Using basic patterns of health network data flow and trust models to support secure communication between network nodes, we abstract network security requirements to a core set to enable secure inter-network data sharing. We propose a minimum set of security controls that can be implemented without needing major new technologies, but yet realize network security and privacy goals of confidentiality, integrity and availability. This framework combines a set of technology mechanisms with environmental controls, and is shown to be sufficient to counter commonly encountered network security threats adequately.

A Security Architecture for Health Information Networks

PubMed Central

Kailar, Rajashekar

2007-01-01

Health information network security needs to balance exacting security controls with practicality, and ease of implementation in today’s healthcare enterprise. Recent work on ‘nationwide health information network’ architectures has sought to share highly confidential data over insecure networks such as the Internet. Using basic patterns of health network data flow and trust models to support secure communication between network nodes, we abstract network security requirements to a core set to enable secure inter-network data sharing. We propose a minimum set of security controls that can be implemented without needing major new technologies, but yet realize network security and privacy goals of confidentiality, integrity and availability. This framework combines a set of technology mechanisms with environmental controls, and is shown to be sufficient to counter commonly encountered network security threats adequately. PMID:18693862

Implementing an Information Security Program

DOE Office of Scientific and Technical Information (OSTI.GOV)

Glantz, Clifford S.; Lenaeus, Joseph D.; Landine, Guy P.

The threats to information security have dramatically increased with the proliferation of information systems and the internet. Chemical, biological, radiological, nuclear, and explosives (CBRNe) facilities need to address these threats in order to protect themselves from the loss of intellectual property, theft of valuable or hazardous materials, and sabotage. Project 19 of the European Union CBRN Risk Mitigation Centres of Excellence Initiative is designed to help CBRN security managers, information technology/cybersecurity managers, and other decision-makers deal with these threats through the application of cost-effective information security programs. Project 19 has developed three guidance documents that are publically available to covermore » information security best practices, planning for an information security management system, and implementing security controls for information security.« less

A Web-based, secure, light weight clinical multimedia data capture and display system.

PubMed

Wang, S S; Starren, J

2000-01-01

Computer-based patient records are traditionally composed of textual data. Integration of multimedia data has been historically slow. Multimedia data such as image, audio, and video have been traditionally more difficult to handle. An implementation of a clinical system for multimedia data is discussed. The system implementation uses Java, Secure Socket Layer (SSL), and Oracle 8i. The system is on top of the Internet so it is architectural independent, cross-platform, cross-vendor, and secure. Design and implementations issues are discussed.

Security concept in 'MyAngelWeb' a website for the individual patient at risk of emergency.

PubMed

Pinciroli, F; Nahaissi, D; Boschini, M; Ferrari, R; Meloni, G; Camnasio, M; Spaggiari, P; Carnerone, G

2000-11-01

We describe the Security Plan for the 'MyAngelWeb' service. The different actors involved in the service are subject to different security procedures. The core of the security system is implemented at the host site by means of a DBMS and standard Information Technology tools. Hardware requirements for sustainable security are needed at the web-site construction sites. They are not needed at the emergency physician's site. At the emergency physician's site, a two-way authentication system (password and test phrase method) is implemented.

Software Development Life Cycle Security Issues

NASA Astrophysics Data System (ADS)

Kaur, Daljit; Kaur, Parminder

2011-12-01

Security is now-a-days one of the major problems because of many reasons. Security is now-a-days one of the major problems because of many reasons. The main cause is that software can't withstand security attacks because of vulnerabilities in it which are caused by defective specifications design and implementation. We have conducted a survey asking software developers, project managers and other people in software development about their security awareness and implementation in Software Development Life Cycle (SDLC). The survey was open to participation for three weeks and this paper explains the survey results.

Security concept in 'MyAngelWeb((R))' a website for the individual patient at risk of emergency.

PubMed

Pinciroli; Nahaissi; Boschini; Ferrari; Meloni; Camnasio; Spaggiari; Carnerone

2000-11-01

We describe the Security Plan for the 'MyAngelWeb' service. The different actors involved in the service are subject to different security procedures. The core of the security system is implemented at the host site by means of a DBMS and standard Information Technology tools. Hardware requirements for sustainable security are needed at the web-site construction sites. They are not needed at the emergency physician's site. At the emergency physician's site, a two-way authentication system (password and test phrase method) is implemented.

J3Gen: A PRNG for Low-Cost Passive RFID

PubMed Central

Melià-Seguí, Joan; Garcia-Alfaro, Joaquin; Herrera-Joancomartí, Jordi

2013-01-01

Pseudorandom number generation (PRNG) is the main security tool in low-cost passive radio-frequency identification (RFID) technologies, such as EPC Gen2. We present a lightweight PRNG design for low-cost passive RFID tags, named J3Gen. J3Gen is based on a linear feedback shift register (LFSR) configured with multiple feedback polynomials. The polynomials are alternated during the generation of sequences via a physical source of randomness. J3Gen successfully handles the inherent linearity of LFSR based PRNGs and satisfies the statistical requirements imposed by the EPC Gen2 standard. A hardware implementation of J3Gen is presented and evaluated with regard to different design parameters, defining the key-equivalence security and nonlinearity of the design. The results of a SPICE simulation confirm the power-consumption suitability of the proposal. PMID:23519344

Plug-and-play measurement-device-independent quantum key distribution

NASA Astrophysics Data System (ADS)

Choi, Yujun; Kwon, Osung; Woo, Minki; Oh, Kyunghwan; Han, Sang-Wook; Kim, Yong-Su; Moon, Sung

2016-03-01

Quantum key distribution (QKD) guarantees unconditional communication security based on the laws of quantum physics. However, practical QKD suffers from a number of quantum hackings due to the device imperfections. From the security standpoint, measurement-device-independent quantum key distribution (MDI-QKD) is in the limelight since it eliminates all the possible loopholes in detection. Due to active control units for mode matching between the photons from remote parties, however, the implementation of MDI-QKD is highly impractical. In this paper, we propose a method to resolve the mode matching problem while minimizing the use of active control units. By introducing the plug-and-play (P&P) concept into MDI-QKD, the indistinguishability in spectral and polarization modes between photons can naturally be guaranteed. We show the feasibility of P&P MDI-QKD with a proof-of-principle experiment.

The Challenges of Balancing Safety and Security in Implantable Medical Devices.

PubMed

Katzis, Konstantinos; Jones, Richard W; Despotou, George

2016-01-01

Modern Implantable Medical Devices (IMDs), implement capabilities that have contributed significantly to patient outcomes, as well as quality of life. The ever increasing connectivity of IMD's does raise security concerns though there are instances where implemented security measures might impact on patient safety. The paper discusses challenges of addressing both of these attributes in parallel.

32 CFR 2004.11 - Agency Implementing Regulations, Internal Rules, or Guidelines [102(b)(3)].

Code of Federal Regulations, 2010 CFR

2010-07-01

... National Defense INFORMATION SECURITY OVERSIGHT OFFICE, NATIONAL ARCHIVES AND RECORDS ADMINISTRATION NATIONAL INDUSTRIAL SECURITY PROGRAM DIRECTIVE NO. 1 Implementation and Oversight § 2004.11 Agency...

The Design Process of Physical Security as Applied to a U.S. Border Point of Entry

DOE Office of Scientific and Technical Information (OSTI.GOV)

Wagner, G.G.

1998-10-26

This paper describes the design process of physical security as applied to a U.S. Border Port of Entry (PoE). Included in this paper are descriptions of the elements that compose U.S. border security. The physical security design will describe the various elements that make up the process as well as the considerations that must be taken into account when dealing with system integration of those elements. The distinctions between preventing unlawful entry and exit of illegal contraband will be emphasized.

Counterfactual quantum cryptography network with untrusted relay

NASA Astrophysics Data System (ADS)

Chen, Yuanyuan; Gu, Xuemei; Jiang, Dong; Xie, Ling; Chen, Lijun

2015-07-01

Counterfactual quantum cryptography allows two remote parties to share a secret key even though a physical particle is not in fact transmitted through the quantum channel. In order to extend the scope of counterfactual quantum cryptography, we use an untrusted relay to construct a multi-user network. The implementation issues are discussed to show that the scheme can be realized with current technologies. We also prove the practical security advantages of the scheme by eliminating the probability that an eavesdropper can directly access the signal or an untrusted relay can perform false operations.

Concepts for a standard based cross-organisational information security management system in the context of a nationwide EHR.

PubMed

Mense, Alexander; Hoheiser-Pförtner, Franz; Schmid, Martin; Wahl, Harald

2013-01-01

Working with health related data necessitates appropriate levels of security and privacy. Information security, meaning ensuring confidentiality, integrity, and availability, is more organizational, than technical in nature. It includes many organizational and management measures, is based on well-defined security roles, processes, and documents, and needs permanent adaption of security policies, continuously monitoring, and measures assessment. This big challenge for any organization leads to implementation of an information security management system (ISMS). In the context of establishing a regional or national electronic health record for integrated care (ICEHR), the situation is worse. Changing the medical information exchange from on-demand peer-to-peer connections to health information networks requires all organizations participating in the EHR system to have consistent security levels and to follow the same security guidelines and rules. Also, the implementation must be monitored and audited, establishing cross-organizational information security management systems (ISMS) based on international standards. This paper evaluates requirements and defines basic concepts for an ISO 27000 series-based cross-organizational ISMS in the healthcare domain and especially for the implementation of the nationwide electronic health record in Austria (ELGA).

10 CFR 1046.12 - Physical fitness training program.

Code of Federal Regulations, 2012 CFR

2012-01-01

... 10 Energy 4 2012-01-01 2012-01-01 false Physical fitness training program. 1046.12 Section 1046.12 Energy DEPARTMENT OF ENERGY (GENERAL PROVISIONS) PHYSICAL PROTECTION OF SECURITY INTERESTS Protective Force Personnel § 1046.12 Physical fitness training program. (a) Each incumbent security police officer...

10 CFR 1046.12 - Physical fitness training program.

Code of Federal Regulations, 2013 CFR

2013-01-01

... 10 Energy 4 2013-01-01 2013-01-01 false Physical fitness training program. 1046.12 Section 1046.12 Energy DEPARTMENT OF ENERGY (GENERAL PROVISIONS) PHYSICAL PROTECTION OF SECURITY INTERESTS Protective Force Personnel § 1046.12 Physical fitness training program. (a) Each incumbent security police officer...

Device interoperability and authentication for telemedical appliance based on the ISO/IEEE 11073 Personal Health Device (PHD) Standards.

PubMed

Caranguian, Luther Paul R; Pancho-Festin, Susan; Sison, Luis G

2012-01-01

In this study, we focused on the interoperability and authentication of medical devices in the context of telemedical systems. A recent standard called the ISO/IEEE 11073 Personal Health Device (X73-PHD) Standards addresses the device interoperability problem by defining common protocols for agent (medical device) and manager (appliance) interface. The X73-PHD standard however has not addressed security and authentication of medical devices which is important in establishing integrity of a telemedical system. We have designed and implemented a security policy within the X73-PHD standards. The policy will enable device authentication using Asymmetric-Key Cryptography and the RSA algorithm as the digital signature scheme. We used two approaches for performing the digital signatures: direct software implementation and use of embedded security modules (ESM). The two approaches were evaluated and compared in terms of execution time and memory requirement. For the standard 2048-bit RSA, ESM calculates digital signatures only 12% of the total time for the direct implementation. Moreover, analysis shows that ESM offers more security advantage such as secure storage of keys compared to using direct implementation. Interoperability with other systems was verified by testing the system with LNI Healthlink, a manager software that implements the X73-PHD standard. Lastly, security analysis was done and the system's response to common attacks on authentication systems was analyzed and several measures were implemented to protect the system against them.

Office of Command Security Total Quality Management Plan

DTIC Science & Technology

1989-07-01

outlines the Office of Command Security instruction for TQM implementation. Keywords: TQM (Total Quality Management ), DLA Office of Command Security, Continuous process improvement, Automatic data processing security.

[The role of environmental factors in managing labour stress].

PubMed

Rados, Melinda; Mészáros, Judit

2017-07-01

Emotional, cognitive and behavioural aspects of birth and labour stress are strongly associated with the underlying physiological processes. To study the factors of physical security and social support, the administration of synthetic oxytocin, and how they relate to perceived stress during childbirth. Women's experienced physical security, social support and oxytocin administration was measured with targeted questions, and their perceived stress with the short and modified version of the Perceived Stress Scale. A strong negative association was found between perceived stress and physical and social security. The group of women experiencing low physical and social security perceived significantly higher stress, while those given synthetic oxytocin perceived higher stress, and lower physical and social security. Since physiological, psychological processes and behaviours are strongly intertwined, the support of natural physiological birth without interventions is recommended, which considers not only short-term but long-term health consequences for mother and child. The contribution of calming physical surroundings, minimal interventions and empowering support of caregivers to safe and satisfying birth is demonstrated in a model. Orv Hetil. 2017; 158(29): 1149-1156.

Aviation security : TSA has completed key activities associated with implementing secure flight, but additional actions are needed to mitigate risks.

DOT National Transportation Integrated Search

2009-05-01

To enhance aviation security, the Department of Homeland Securitys (DHS) Transportation Security Administration (TSA) developed a programknown as Secure Flightto assume from air carriers the function of matching passenger information against...

Secure environment for real-time tele-collaboration on virtual simulation of radiation treatment planning.

PubMed

Ntasis, Efthymios; Maniatis, Theofanis A; Nikita, Konstantina S

2003-01-01

A secure framework is described for real-time tele-collaboration on Virtual Simulation procedure of Radiation Treatment Planning. An integrated approach is followed clustering the security issues faced by the system into organizational issues, security issues over the LAN and security issues over the LAN-to-LAN connection. The design and the implementation of the security services are performed according to the identified security requirements, along with the need for real time communication between the collaborating health care professionals. A detailed description of the implementation is given, presenting a solution, which can directly be tailored to other tele-collaboration services in the field of health care. The pilot study of the proposed security components proves the feasibility of the secure environment, and the consistency with the high performance demands of the application.

Comparative Assessment of Physical and Social Determinants of Water Quantity and Water Quality Concerns

NASA Astrophysics Data System (ADS)

Gunda, T.; Hornberger, G. M.

2017-12-01

Concerns over water resources have evolved over time, from physical availability to economic access and recently, to a more comprehensive study of "water security," which is inherently interdisciplinary because a secure water system is influenced by and affects both physical and social components. The concept of water security carries connotations of both an adequate supply of water as well as water that meets certain quality standards. Although the term "water security" has many interpretations in the literature, the research field has not yet developed a synthetic analysis of water security as both a quantity (availability) and quality (contamination) issue. Using qualitative comparative and multi-regression analyses, we evaluate the primary physical and social factors influencing U.S. states' water security from a quantity perspective and from a quality perspective. Water system characteristics are collated from academic and government sources and include access/use, governance, and sociodemographic, and ecosystem metrics. Our analysis indicates differences in variables driving availability and contamination concerns; for example, climate is a more significant determinant in water quantity-based security analyses than in water quality-based security analyses. We will also discuss coevolution of system traits and the merits of constructing a robust water security index based on the relative importance of metrics from our analyses. These insights will improve understanding of the complex interactions between quantity and quality aspects and thus, overall security of water systems.

Design and Smartphone-Based Implementation of a Chaotic Video Communication Scheme via WAN Remote Transmission

NASA Astrophysics Data System (ADS)

Lin, Zhuosheng; Yu, Simin; Li, Chengqing; Lü, Jinhu; Wang, Qianxue

This paper proposes a chaotic secure video remote communication scheme that can perform on real WAN networks, and implements it on a smartphone hardware platform. First, a joint encryption and compression scheme is designed by embedding a chaotic encryption scheme into the MJPG-Streamer source codes. Then, multiuser smartphone communications between the sender and the receiver are implemented via WAN remote transmission. Finally, the transmitted video data are received with the given IP address and port in an Android smartphone. It should be noted that, this is the first time that chaotic video encryption schemes are implemented on such a hardware platform. The experimental results demonstrate that the technical challenges on hardware implementation of secure video communication are successfully solved, reaching a balance amongst sufficient security level, real-time processing of massive video data, and utilization of available resources in the hardware environment. The proposed scheme can serve as a good application example of chaotic secure communications for smartphone and other mobile facilities in the future.

Implementation of continuous-variable quantum key distribution with composable and one-sided-device-independent security against coherent attacks.

PubMed

Gehring, Tobias; Händchen, Vitus; Duhme, Jörg; Furrer, Fabian; Franz, Torsten; Pacher, Christoph; Werner, Reinhard F; Schnabel, Roman

2015-10-30

Secret communication over public channels is one of the central pillars of a modern information society. Using quantum key distribution this is achieved without relying on the hardness of mathematical problems, which might be compromised by improved algorithms or by future quantum computers. State-of-the-art quantum key distribution requires composable security against coherent attacks for a finite number of distributed quantum states as well as robustness against implementation side channels. Here we present an implementation of continuous-variable quantum key distribution satisfying these requirements. Our implementation is based on the distribution of continuous-variable Einstein-Podolsky-Rosen entangled light. It is one-sided device independent, which means the security of the generated key is independent of any memoryfree attacks on the remote detector. Since continuous-variable encoding is compatible with conventional optical communication technology, our work is a step towards practical implementations of quantum key distribution with state-of-the-art security based solely on telecom components.

Implementation of continuous-variable quantum key distribution with composable and one-sided-device-independent security against coherent attacks

PubMed Central

Gehring, Tobias; Händchen, Vitus; Duhme, Jörg; Furrer, Fabian; Franz, Torsten; Pacher, Christoph; Werner, Reinhard F.; Schnabel, Roman

2015-01-01

Secret communication over public channels is one of the central pillars of a modern information society. Using quantum key distribution this is achieved without relying on the hardness of mathematical problems, which might be compromised by improved algorithms or by future quantum computers. State-of-the-art quantum key distribution requires composable security against coherent attacks for a finite number of distributed quantum states as well as robustness against implementation side channels. Here we present an implementation of continuous-variable quantum key distribution satisfying these requirements. Our implementation is based on the distribution of continuous-variable Einstein–Podolsky–Rosen entangled light. It is one-sided device independent, which means the security of the generated key is independent of any memoryfree attacks on the remote detector. Since continuous-variable encoding is compatible with conventional optical communication technology, our work is a step towards practical implementations of quantum key distribution with state-of-the-art security based solely on telecom components. PMID:26514280

An eCK-Secure Authenticated Key Exchange Protocol without Random Oracles

NASA Astrophysics Data System (ADS)

Moriyama, Daisuke; Okamoto, Tatsuaki

This paper presents a (PKI-based) two-pass authenticated key exchange (AKE) protocol that is secure in the extended Canetti-Krawczyk (eCK) security model. The security of the proposed protocol is proven without random oracles (under three assumptions), and relies on no implementation techniques such as a trick by LaMacchia, Lauter and Mityagin (so-called the NAXOS trick). Since an AKE protocol that is eCK-secure under a NAXOS-like implementation trick will be no more eCK-secure if some realistic information leakage occurs through side-channel attacks, it has been an important open problem how to realize an eCK-secure AKE protocol without using the NAXOS tricks (and without random oracles).

75 FR 50845 - Privacy Act of 1974: Implementation of Exemptions; Department of Homeland Security/ALL-027 The...

Federal Register 2010, 2011, 2012, 2013, 2014

2010-08-18

... Policy, Department of Homeland Security, Washington, DC 20528. For privacy issues please contact: Mary...;Prices of new books are listed in the first FEDERAL REGISTER issue of each #0;week. #0; #0; #0; #0;#0...] Privacy Act of 1974: Implementation of Exemptions; Department of Homeland Security/ALL--027 The History of...

Effectiveness of Using a Change Management Approach to Convey the Benefits of an Information Security Implementation to Technology Users

ERIC Educational Resources Information Center

Bennett, Jeannine B.

2012-01-01

This study addressed the problems associated with users' understanding, accepting, and complying with requirements of security-oriented solutions. The goal of the research was not to dispute existing theory on IT project implementations, but rather to further the knowledge on the topic of technology user acceptance of security-oriented IT…

Mobile Virtual Private Networking

NASA Astrophysics Data System (ADS)

Pulkkis, Göran; Grahn, Kaj; Mårtens, Mathias; Mattsson, Jonny

Mobile Virtual Private Networking (VPN) solutions based on the Internet Security Protocol (IPSec), Transport Layer Security/Secure Socket Layer (SSL/TLS), Secure Shell (SSH), 3G/GPRS cellular networks, Mobile IP, and the presently experimental Host Identity Protocol (HIP) are described, compared and evaluated. Mobile VPN solutions based on HIP are recommended for future networking because of superior processing efficiency and network capacity demand features. Mobile VPN implementation issues associated with the IP protocol versions IPv4 and IPv6 are also evaluated. Mobile VPN implementation experiences are presented and discussed.

Organizational Culture for Safety, Security, and Safeguards in New Nuclear Power Countries

DOE Office of Scientific and Technical Information (OSTI.GOV)

Kovacic, Donald N

2015-01-01

This chapter will contain the following sections: Existing international norms and standards for developing the infrastructure to support new nuclear power programs The role of organizational culture and how it supports the safe, secure, and peaceful application of nuclear power Identifying effective and efficient strategies for implementing safety, security and safeguards in nuclear operations Challenges identified in the implementation of safety, security and safeguards Potential areas for future collaboration between countries in order to support nonproliferation culture

A Web-based, secure, light weight clinical multimedia data capture and display system.

PubMed Central

Wang, S. S.; Starren, J.

2000-01-01

Computer-based patient records are traditionally composed of textual data. Integration of multimedia data has been historically slow. Multimedia data such as image, audio, and video have been traditionally more difficult to handle. An implementation of a clinical system for multimedia data is discussed. The system implementation uses Java, Secure Socket Layer (SSL), and Oracle 8i. The system is on top of the Internet so it is architectural independent, cross-platform, cross-vendor, and secure. Design and implementations issues are discussed. Images Figure 2 Figure 3 PMID:11080014

High speed fault tolerant secure communication for muon chamber using FPGA based GBTx emulator

NASA Astrophysics Data System (ADS)

Sau, Suman; Mandal, Swagata; Saini, Jogender; Chakrabarti, Amlan; Chattopadhyay, Subhasis

2015-12-01

The Compressed Baryonic Matter (CBM) experiment is a part of the Facility for Antiproton and Ion Research (FAIR) in Darmstadt at the GSI. The CBM experiment will investigate the highly compressed nuclear matter using nucleus-nucleus collisions. This experiment will examine lieavy-ion collisions in fixed target geometry and will be able to measure hadrons, electrons and muons. CBM requires precise time synchronization, compact hardware, radiation tolerance, self-triggered front-end electronics, efficient data aggregation schemes and capability to handle high data rate (up to several TB/s). As a part of the implementation of read out chain of Muon Cliamber(MUCH) [1] in India, we have tried to implement FPGA based emulator of GBTx in India. GBTx is a radiation tolerant ASIC that can be used to implement multipurpose high speed bidirectional optical links for high-energy physics (HEP) experiments and is developed by CERN. GBTx will be used in highly irradiated area and more prone to be affected by multi bit error. To mitigate this effect instead of single bit error correcting RS code we have used two bit error correcting (15, 7) BCH code. It will increase the redundancy which in turn increases the reliability of the coded data. So the coded data will be less prone to be affected by noise due to radiation. The data will go from detector to PC through multiple nodes through the communication channel. The computing resources are connected to a network which can be accessed by authorized person to prevent unauthorized data access which might happen by compromising the network security. Thus data encryption is essential. In order to make the data communication secure, advanced encryption standard [2] (AES - a symmetric key cryptography) and RSA [3], [4] (asymmetric key cryptography) are used after the channel coding. We have implemented GBTx emulator on two Xilinx Kintex-7 boards (KC705). One will act as transmitter and other will act as receiver and they are connected through optical fiber through small form-factor pluggable (SFP) port. We have tested the setup in the runtime environment using Xilinx Cliipscope Pro Analyzer. We also measure the resource utilization, throughput., power optimization of implemented design.

Building Security into Schools.

ERIC Educational Resources Information Center

Kosar, John E.; Ahmed, Faruq

2000-01-01

Offers tips for redesigning safer school sites; installing and implementing security technologies (closed-circuit television cameras, door security hardware, electronic security panels, identification cards, metal detectors, and panic buttons); educating students and staff about security functions; and minimizing costs via a comprehensive campus…

78 FR 10169 - Federal Advisory Committee Act; Communications Security, Reliability, and Interoperability Council

Federal Register 2010, 2011, 2012, 2013, 2014

2013-02-13

... Location Accuracy, Network Security Best Practices, DNSSEC Implementation Practices for ISPs, Secure BGP... FEDERAL COMMUNICATIONS COMMISSION Federal Advisory Committee Act; Communications Security... persons that the Federal Communications Commission's (FCC) Communications Security, Reliability, and...

Security model for picture archiving and communication systems.

PubMed

Harding, D B; Gac, R J; Reynolds, C T; Romlein, J; Chacko, A K

2000-05-01

The modern information revolution has facilitated a metamorphosis of health care delivery wrought with the challenges of securing patient sensitive data. To accommodate this reality, Congress passed the Health Insurance Portability and Accountability Act (HIPAA). While final guidance has not fully been resolved at this time, it is up to the health care community to develop and implement comprehensive security strategies founded on procedural, hardware and software solutions in preparation for future controls. The Virtual Radiology Environment (VRE) Project, a landmark US Army picture archiving and communications system (PACS) implemented across 10 geographically dispersed medical facilities, has addressed that challenge by planning for the secure transmission of medical images and reports over their local (LAN) and wide area network (WAN) infrastructure. Their model, which is transferable to general PACS implementations, encompasses a strategy of application risk and dataflow identification, data auditing, security policy definition, and procedural controls. When combined with hardware and software solutions that are both non-performance limiting and scalable, the comprehensive approach will not only sufficiently address the current security requirements, but also accommodate the natural evolution of the enterprise security model.

An Embedded Sensor Node Microcontroller with Crypto-Processors.

PubMed

Panić, Goran; Stecklina, Oliver; Stamenković, Zoran

2016-04-27

Wireless sensor network applications range from industrial automation and control, agricultural and environmental protection, to surveillance and medicine. In most applications, data are highly sensitive and must be protected from any type of attack and abuse. Security challenges in wireless sensor networks are mainly defined by the power and computing resources of sensor devices, memory size, quality of radio channels and susceptibility to physical capture. In this article, an embedded sensor node microcontroller designed to support sensor network applications with severe security demands is presented. It features a low power 16-bitprocessor core supported by a number of hardware accelerators designed to perform complex operations required by advanced crypto algorithms. The microcontroller integrates an embedded Flash and an 8-channel 12-bit analog-to-digital converter making it a good solution for low-power sensor nodes. The article discusses the most important security topics in wireless sensor networks and presents the architecture of the proposed hardware solution. Furthermore, it gives details on the chip implementation, verification and hardware evaluation. Finally, the chip power dissipation and performance figures are estimated and analyzed.

An Embedded Sensor Node Microcontroller with Crypto-Processors

PubMed Central

Panić, Goran; Stecklina, Oliver; Stamenković, Zoran

2016-01-01

Wireless sensor network applications range from industrial automation and control, agricultural and environmental protection, to surveillance and medicine. In most applications, data are highly sensitive and must be protected from any type of attack and abuse. Security challenges in wireless sensor networks are mainly defined by the power and computing resources of sensor devices, memory size, quality of radio channels and susceptibility to physical capture. In this article, an embedded sensor node microcontroller designed to support sensor network applications with severe security demands is presented. It features a low power 16-bitprocessor core supported by a number of hardware accelerators designed to perform complex operations required by advanced crypto algorithms. The microcontroller integrates an embedded Flash and an 8-channel 12-bit analog-to-digital converter making it a good solution for low-power sensor nodes. The article discusses the most important security topics in wireless sensor networks and presents the architecture of the proposed hardware solution. Furthermore, it gives details on the chip implementation, verification and hardware evaluation. Finally, the chip power dissipation and performance figures are estimated and analyzed. PMID:27128925

Guidelines for Automatic Data Processing Physical Security and Risk Management. Federal Information Processing Standards Publication 31.

ERIC Educational Resources Information Center

National Bureau of Standards (DOC), Washington, DC.

These guidelines provide a handbook for use by federal organizations in structuring physical security and risk management programs for their automatic data processing facilities. This publication discusses security analysis, natural disasters, supporting utilities, system reliability, procedural measures and controls, off-site facilities,…

10 CFR 76.111 - Physical security, material control and accounting, and protection of certain information.

Code of Federal Regulations, 2010 CFR

2010-01-01

... significance (Category III), and for protection of Restricted Data, National Security Information, Safeguards... 10 Energy 2 2010-01-01 2010-01-01 false Physical security, material control and accounting, and protection of certain information. 76.111 Section 76.111 Energy NUCLEAR REGULATORY COMMISSION (CONTINUED...

Application of visual cryptography for learning in optics and photonics

NASA Astrophysics Data System (ADS)

Mandal, Avikarsha; Wozniak, Peter; Vauderwange, Oliver; Curticapean, Dan

2016-09-01

In the age data digitalization, important applications of optics and photonics based sensors and technology lie in the field of biometrics and image processing. Protecting user data in a safe and secure way is an essential task in this area. However, traditional cryptographic protocols rely heavily on computer aided computation. Secure protocols which rely only on human interactions are usually simpler to understand. In many scenarios development of such protocols are also important for ease of implementation and deployment. Visual cryptography (VC) is an encryption technique on images (or text) in which decryption is done by human visual system. In this technique, an image is encrypted into number of pieces (known as shares). When the printed shares are physically superimposed together, the image can be decrypted with human vision. Modern digital watermarking technologies can be combined with VC for image copyright protection where the shares can be watermarks (small identification) embedded in the image. Similarly, VC can be used for improving security of biometric authentication. This paper presents about design and implementation of a practical laboratory experiment based on the concept of VC for a course in media engineering. Specifically, our contribution deals with integration of VC in different schemes for applications like digital watermarking and biometric authentication in the field of optics and photonics. We describe theoretical concepts and propose our infrastructure for the experiment. Finally, we will evaluate the learning outcome of the experiment, performed by the students.

32 CFR 2700.51 - Information Security Oversight Committee.

Code of Federal Regulations, 2011 CFR

2011-07-01

... 32 National Defense 6 2011-07-01 2011-07-01 false Information Security Oversight Committee. 2700... MICRONESIAN STATUS NEGOTIATIONS SECURITY INFORMATION REGULATIONS Implementation and Review § 2700.51 Information Security Oversight Committee. The OMSN Information Security Oversight Committee shall be chaired...

32 CFR 2700.51 - Information Security Oversight Committee.

Code of Federal Regulations, 2010 CFR

2010-07-01

... 32 National Defense 6 2010-07-01 2010-07-01 false Information Security Oversight Committee. 2700... MICRONESIAN STATUS NEGOTIATIONS SECURITY INFORMATION REGULATIONS Implementation and Review § 2700.51 Information Security Oversight Committee. The OMSN Information Security Oversight Committee shall be chaired...

76 FR 52353 - Assumption Buster Workshop: “Current Implementations of Cloud Computing Indicate a New Approach...

Federal Register 2010, 2011, 2012, 2013, 2014

2011-08-22

... explored in this series is cloud computing. The workshop on this topic will be held in Gaithersburg, MD on October 21, 2011. Assertion: ``Current implementations of cloud computing indicate a new approach to security'' Implementations of cloud computing have provided new ways of thinking about how to secure data...

Cyber security challenges in Smart Cities: Safety, security and privacy.

PubMed

Elmaghraby, Adel S; Losavio, Michael M

2014-07-01

The world is experiencing an evolution of Smart Cities. These emerge from innovations in information technology that, while they create new economic and social opportunities, pose challenges to our security and expectations of privacy. Humans are already interconnected via smart phones and gadgets. Smart energy meters, security devices and smart appliances are being used in many cities. Homes, cars, public venues and other social systems are now on their path to the full connectivity known as the "Internet of Things." Standards are evolving for all of these potentially connected systems. They will lead to unprecedented improvements in the quality of life. To benefit from them, city infrastructures and services are changing with new interconnected systems for monitoring, control and automation. Intelligent transportation, public and private, will access a web of interconnected data from GPS location to weather and traffic updates. Integrated systems will aid public safety, emergency responders and in disaster recovery. We examine two important and entangled challenges: security and privacy. Security includes illegal access to information and attacks causing physical disruptions in service availability. As digital citizens are more and more instrumented with data available about their location and activities, privacy seems to disappear. Privacy protecting systems that gather data and trigger emergency response when needed are technological challenges that go hand-in-hand with the continuous security challenges. Their implementation is essential for a Smart City in which we would wish to live. We also present a model representing the interactions between person, servers and things. Those are the major element in the Smart City and their interactions are what we need to protect.

Quantum communication with coherent states of light

NASA Astrophysics Data System (ADS)

Khan, Imran; Elser, Dominique; Dirmeier, Thomas; Marquardt, Christoph; Leuchs, Gerd

2017-06-01

Quantum communication offers long-term security especially, but not only, relevant to government and industrial users. It is worth noting that, for the first time in the history of cryptographic encoding, we are currently in the situation that secure communication can be based on the fundamental laws of physics (information theoretical security) rather than on algorithmic security relying on the complexity of algorithms, which is periodically endangered as standard computer technology advances. On a fundamental level, the security of quantum key distribution (QKD) relies on the non-orthogonality of the quantum states used. So even coherent states are well suited for this task, the quantum states that largely describe the light generated by laser systems. Depending on whether one uses detectors resolving single or multiple photon states or detectors measuring the field quadratures, one speaks of, respectively, a discrete- or a continuous-variable description. Continuous-variable QKD with coherent states uses a technology that is very similar to the one employed in classical coherent communication systems, the backbone of today's Internet connections. Here, we review recent developments in this field in two connected regimes: (i) improving QKD equipment by implementing front-end telecom devices and (ii) research into satellite QKD for bridging long distances by building upon existing optical satellite links. This article is part of the themed issue 'Quantum technology for the 21st century'.

Quantum communication with coherent states of light.

PubMed

Khan, Imran; Elser, Dominique; Dirmeier, Thomas; Marquardt, Christoph; Leuchs, Gerd

2017-08-06

Quantum communication offers long-term security especially, but not only, relevant to government and industrial users. It is worth noting that, for the first time in the history of cryptographic encoding, we are currently in the situation that secure communication can be based on the fundamental laws of physics (information theoretical security) rather than on algorithmic security relying on the complexity of algorithms, which is periodically endangered as standard computer technology advances. On a fundamental level, the security of quantum key distribution (QKD) relies on the non-orthogonality of the quantum states used. So even coherent states are well suited for this task, the quantum states that largely describe the light generated by laser systems. Depending on whether one uses detectors resolving single or multiple photon states or detectors measuring the field quadratures, one speaks of, respectively, a discrete- or a continuous-variable description. Continuous-variable QKD with coherent states uses a technology that is very similar to the one employed in classical coherent communication systems, the backbone of today's Internet connections. Here, we review recent developments in this field in two connected regimes: (i) improving QKD equipment by implementing front-end telecom devices and (ii) research into satellite QKD for bridging long distances by building upon existing optical satellite links.This article is part of the themed issue 'Quantum technology for the 21st century'. © 2017 The Author(s).

Control and Communication for a Secure and Reconfigurable Power Distribution System

NASA Astrophysics Data System (ADS)

Giacomoni, Anthony Michael

A major transformation is taking place throughout the electric power industry to overlay existing electric infrastructure with advanced sensing, communications, and control system technologies. This transformation to a smart grid promises to enhance system efficiency, increase system reliability, support the electrification of transportation, and provide customers with greater control over their electricity consumption. Upgrading control and communication systems for the end-to-end electric power grid, however, will present many new security challenges that must be dealt with before extensive deployment and implementation of these technologies can begin. In this dissertation, a comprehensive systems approach is taken to minimize and prevent cyber-physical disturbances to electric power distribution systems using sensing, communications, and control system technologies. To accomplish this task, an intelligent distributed secure control (IDSC) architecture is presented and validated in silico for distribution systems to provide greater adaptive protection, with the ability to proactively reconfigure, and rapidly respond to disturbances. Detailed descriptions of functionalities at each layer of the architecture as well as the whole system are provided. To compare the performance of the IDSC architecture with that of other control architectures, an original simulation methodology is developed. The simulation model integrates aspects of cyber-physical security, dynamic price and demand response, sensing, communications, intermittent distributed energy resources (DERs), and dynamic optimization and reconfiguration. Applying this comprehensive systems approach, performance results for the IEEE 123 node test feeder are simulated and analyzed. The results show the trade-offs between system reliability, operational constraints, and costs for several control architectures and optimization algorithms. Additional simulation results are also provided. In particular, the advantages of an IDSC architecture are highlighted when an intermittent DER is present on the system.

Impact of primary healthcare providers' initial role security and therapeutic commitment on implementing brief interventions in managing risky alcohol consumption: a cluster randomised factorial trial.

PubMed

Keurhorst, M; Anderson, P; Heinen, M; Bendtsen, Preben; Baena, Begoña; Brzózka, Krzysztof; Colom, Joan; Deluca, Paolo; Drummond, Colin; Kaner, Eileen; Kłoda, Karolina; Mierzecki, Artur; Newbury-Birch, Dorothy; Okulicz-Kozaryn, Katarzyna; Palacio-Vieira, Jorge; Parkinson, Kathryn; Reynolds, Jillian; Ronda, Gaby; Segura, Lidia; Słodownik, Luiza; Spak, Fredrik; van Steenkiste, Ben; Wallace, Paul; Wolstenholme, Amy; Wojnar, Marcin; Gual, Antoni; Laurant, M; Wensing, M

2016-07-16

Brief interventions in primary healthcare are cost-effective in reducing drinking problems but poorly implemented in routine practice. Although evidence about implementing brief interventions is growing, knowledge is limited with regard to impact of initial role security and therapeutic commitment on brief intervention implementation. In a cluster randomised factorial trial, 120 primary healthcare units (PHCUs) were randomised to eight groups: care as usual, training and support, financial reimbursement, and the opportunity to refer patients to an internet-based brief intervention (e-BI); paired combinations of these three strategies, and all three strategies combined. To explore the impact of initial role security and therapeutic commitment on implementing brief interventions, we performed multilevel linear regression analyses adapted to the factorial design. Data from 746 providers from 120 PHCUs were included in the analyses. Baseline role security and therapeutic commitment were found not to influence implementation of brief interventions. Furthermore, there were no significant interactions between these characteristics and allocated implementation groups. The extent to which providers changed their brief intervention delivery following experience of different implementation strategies was not determined by their initial attitudes towards alcohol problems. In future research, more attention is needed to unravel the causal relation between practitioners' attitudes, their actual behaviour and care improvement strategies to enhance implementation science. ClinicalTrials.gov: NCT01501552.

A Chaos MIMO-OFDM Scheme for Mobile Communication with Physical-Layer Security

NASA Astrophysics Data System (ADS)

Okamoto, Eiji

Chaos communications enable a physical-layer security, which can enhance the transmission security in combining with upper-layer encryption techniques, or can omit the upper-layer secure protocol and enlarges the transmission efficiency. However, the chaos communication usually degrades the error rate performance compared to unencrypted digital modulations. To achieve both physical-layer security and channel coding gain, we have proposed a chaos multiple-input multiple-output (MIMO) scheme in which a rate-one chaos convolution is applied to MIMO multiplexing. However, in the conventional study only flat fading is considered. To apply this scheme to practical mobile environments, i.e., multipath fading channels, we propose a chaos MIMO-orthogonal frequency division multi-plexing (OFDM) scheme and show its effectiveness through computer simulations.

Experimental quantum key distribution with source flaws

NASA Astrophysics Data System (ADS)

Xu, Feihu; Wei, Kejin; Sajeed, Shihan; Kaiser, Sarah; Sun, Shihai; Tang, Zhiyuan; Qian, Li; Makarov, Vadim; Lo, Hoi-Kwong

2015-09-01

Decoy-state quantum key distribution (QKD) is a standard technique in current quantum cryptographic implementations. Unfortunately, existing experiments have two important drawbacks: the state preparation is assumed to be perfect without errors and the employed security proofs do not fully consider the finite-key effects for general attacks. These two drawbacks mean that existing experiments are not guaranteed to be proven to be secure in practice. Here, we perform an experiment that shows secure QKD with imperfect state preparations over long distances and achieves rigorous finite-key security bounds for decoy-state QKD against coherent attacks in the universally composable framework. We quantify the source flaws experimentally and demonstrate a QKD implementation that is tolerant to channel loss despite the source flaws. Our implementation considers more real-world problems than most previous experiments, and our theory can be applied to general discrete-variable QKD systems. These features constitute a step towards secure QKD with imperfect devices.

PRESAGE: PRivacy-preserving gEnetic testing via SoftwAre Guard Extension.

PubMed

Chen, Feng; Wang, Chenghong; Dai, Wenrui; Jiang, Xiaoqian; Mohammed, Noman; Al Aziz, Md Momin; Sadat, Md Nazmus; Sahinalp, Cenk; Lauter, Kristin; Wang, Shuang

2017-07-26

Advances in DNA sequencing technologies have prompted a wide range of genomic applications to improve healthcare and facilitate biomedical research. However, privacy and security concerns have emerged as a challenge for utilizing cloud computing to handle sensitive genomic data. We present one of the first implementations of Software Guard Extension (SGX) based securely outsourced genetic testing framework, which leverages multiple cryptographic protocols and minimal perfect hash scheme to enable efficient and secure data storage and computation outsourcing. We compared the performance of the proposed PRESAGE framework with the state-of-the-art homomorphic encryption scheme, as well as the plaintext implementation. The experimental results demonstrated significant performance over the homomorphic encryption methods and a small computational overhead in comparison to plaintext implementation. The proposed PRESAGE provides an alternative solution for secure and efficient genomic data outsourcing in an untrusted cloud by using a hybrid framework that combines secure hardware and multiple crypto protocols.

Dealing with school shootings, violence: how Jonesboro and Denver hospitals met this new challenge to emergency preparedness.

PubMed

1999-08-01

Acts of violence at schools across the country committed by gun-wielding students in recent years have all too frequently, as we know by now, resulted in multiple casualties and widespread community grieving. Two of the shooting rampages noted in this report that attracted national and international media attention--one at West-side Middle School, Jonesboro, AR, on March 24, 1998, and the other at Columbine High School, Littleton, CO, on April 20, 1999--illustrate the importance of hospital preparedness and quick implementation of emergency disaster plans. In both instances, officials say their administrative, clinical, and security personnel were well prepared to handle the physical and emotional trauma caused by the tragedies. Meanwhile, a leading criminologist warns that the trend toward school violence likely will continue and provides tips for hospitals and their security directors.

High-speed true random number generation based on paired memristors for security electronics

NASA Astrophysics Data System (ADS)

Zhang, Teng; Yin, Minghui; Xu, Changmin; Lu, Xiayan; Sun, Xinhao; Yang, Yuchao; Huang, Ru

2017-11-01

True random number generator (TRNG) is a critical component in hardware security that is increasingly important in the era of mobile computing and internet of things. Here we demonstrate a TRNG using intrinsic variation of memristors as a natural source of entropy that is otherwise undesirable in most applications. The random bits were produced by cyclically switching a pair of tantalum oxide based memristors and comparing their resistance values in the off state, taking advantage of the more pronounced resistance variation compared with that in the on state. Using an alternating read scheme in the designed TRNG circuit, the unbiasedness of the random numbers was significantly improved, and the bitstream passed standard randomness tests. The Pt/TaO x /Ta memristors fabricated in this work have fast programming/erasing speeds of ˜30 ns, suggesting a high random number throughput. The approach proposed here thus holds great promise for physically-implemented random number generation.

High-speed true random number generation based on paired memristors for security electronics.

PubMed

Zhang, Teng; Yin, Minghui; Xu, Changmin; Lu, Xiayan; Sun, Xinhao; Yang, Yuchao; Huang, Ru

2017-11-10

True random number generator (TRNG) is a critical component in hardware security that is increasingly important in the era of mobile computing and internet of things. Here we demonstrate a TRNG using intrinsic variation of memristors as a natural source of entropy that is otherwise undesirable in most applications. The random bits were produced by cyclically switching a pair of tantalum oxide based memristors and comparing their resistance values in the off state, taking advantage of the more pronounced resistance variation compared with that in the on state. Using an alternating read scheme in the designed TRNG circuit, the unbiasedness of the random numbers was significantly improved, and the bitstream passed standard randomness tests. The Pt/TaO x /Ta memristors fabricated in this work have fast programming/erasing speeds of ∼30 ns, suggesting a high random number throughput. The approach proposed here thus holds great promise for physically-implemented random number generation.

PRINCESS: Privacy-protecting Rare disease International Network Collaboration via Encryption through Software guard extensionS

PubMed Central

Chen, Feng; Wang, Shuang; Jiang, Xiaoqian; Ding, Sijie; Lu, Yao; Kim, Jihoon; Sahinalp, S. Cenk; Shimizu, Chisato; Burns, Jane C.; Wright, Victoria J.; Png, Eileen; Hibberd, Martin L.; Lloyd, David D.; Yang, Hai; Telenti, Amalio; Bloss, Cinnamon S.; Fox, Dov; Lauter, Kristin; Ohno-Machado, Lucila

2017-01-01

Abstract Motivation: We introduce PRINCESS, a privacy-preserving international collaboration framework for analyzing rare disease genetic data that are distributed across different continents. PRINCESS leverages Software Guard Extensions (SGX) and hardware for trustworthy computation. Unlike a traditional international collaboration model, where individual-level patient DNA are physically centralized at a single site, PRINCESS performs a secure and distributed computation over encrypted data, fulfilling institutional policies and regulations for protected health information. Results: To demonstrate PRINCESS’ performance and feasibility, we conducted a family-based allelic association study for Kawasaki Disease, with data hosted in three different continents. The experimental results show that PRINCESS provides secure and accurate analyses much faster than alternative solutions, such as homomorphic encryption and garbled circuits (over 40 000× faster). Availability and Implementation: https://github.com/achenfengb/PRINCESS_opensource Contact: shw070@ucsd.edu Supplementary information: Supplementary data are available at Bioinformatics online. PMID:28065902

High-rate measurement-device-independent quantum cryptography

NASA Astrophysics Data System (ADS)

Pirandola, Stefano; Ottaviani, Carlo; Spedalieri, Gaetana; Weedbrook, Christian; Braunstein, Samuel L.; Lloyd, Seth; Gehring, Tobias; Jacobsen, Christian S.; Andersen, Ulrik L.

2015-06-01

Quantum cryptography achieves a formidable task—the remote distribution of secret keys by exploiting the fundamental laws of physics. Quantum cryptography is now headed towards solving the practical problem of constructing scalable and secure quantum networks. A significant step in this direction has been the introduction of measurement-device independence, where the secret key between two parties is established by the measurement of an untrusted relay. Unfortunately, although qubit-implemented protocols can reach long distances, their key rates are typically very low, unsuitable for the demands of a metropolitan network. Here we show, theoretically and experimentally, that a solution can come from the use of continuous-variable systems. We design a coherent-state network protocol able to achieve remarkably high key rates at metropolitan distances, in fact three orders of magnitude higher than those currently achieved. Our protocol could be employed to build high-rate quantum networks where devices securely connect to nearby access points or proxy servers.

Experimental quantum key distribution with finite-key security analysis for noisy channels.

PubMed

Bacco, Davide; Canale, Matteo; Laurenti, Nicola; Vallone, Giuseppe; Villoresi, Paolo

2013-01-01

In quantum key distribution implementations, each session is typically chosen long enough so that the secret key rate approaches its asymptotic limit. However, this choice may be constrained by the physical scenario, as in the perspective use with satellites, where the passage of one terminal over the other is restricted to a few minutes. Here we demonstrate experimentally the extraction of secure keys leveraging an optimal design of the prepare-and-measure scheme, according to recent finite-key theoretical tight bounds. The experiment is performed in different channel conditions, and assuming two distinct attack models: individual attacks or general quantum attacks. The request on the number of exchanged qubits is then obtained as a function of the key size and of the ambient quantum bit error rate. The results indicate that viable conditions for effective symmetric, and even one-time-pad, cryptography are achievable.

12 CFR Appendix B to Part 30 - Interagency Guidelines Establishing Information Security Standards

Code of Federal Regulations, 2011 CFR

2011-01-01

... Establishing Information Security Standards Table of Contents I. Introduction A. Scope B. Preservation of... Security Program B. Objectives III. Development and Implementation of Customer Information Security Program.... Introduction The Interagency Guidelines Establishing Information Security Standards (Guidelines) set forth...

33 CFR 101.100 - Purpose.

Code of Federal Regulations, 2010 CFR

2010-07-01

... Navigation and Navigable Waters COAST GUARD, DEPARTMENT OF HOMELAND SECURITY MARITIME SECURITY MARITIME SECURITY: GENERAL General § 101.100 Purpose. (a) The purpose of this subchapter is: (1) To implement portions of the maritime security regime required by the Maritime Transportation Security Act of 2002, as...

An Anti-Electromagnetic Attack PUF Based on a Configurable Ring Oscillator for Wireless Sensor Networks

PubMed Central

Lu, Zhaojun; Li, Dongfang; Liu, Hailong; Gong, Mingyang; Liu, Zhenglin

2017-01-01

Wireless sensor networks (WSNs) are an emerging technology employed in some crucial applications. However, limited resources and physical exposure to attackers make security a challenging issue for a WSN. Ring oscillator-based physical unclonable function (RO PUF) is a potential option to protect the security of sensor nodes because it is able to generate random responses efficiently for a key extraction mechanism, which prevents the non-volatile memory from storing secret keys. In order to deploy RO PUF in a WSN, hardware efficiency, randomness, uniqueness, and reliability should be taken into account. Besides, the resistance to electromagnetic (EM) analysis attack is important to guarantee the security of RO PUF itself. In this paper, we propose a novel architecture of configurable RO PUF based on exclusive-or (XOR) gates. First, it dramatically increases the hardware efficiency compared with other types of RO PUFs. Second, it mitigates the vulnerability to EM analysis attack by placing the adjacent RO arrays in accordance with the cosine wave and sine wave so that the frequency of each RO cannot be detected. We implement our proposal in XINLINX A-7 field programmable gate arrays (FPGAs) and conduct a set of experiments to evaluate the quality of the responses. The results show that responses pass the National Institute of Standards and Technology (NIST) statistical test and have good uniqueness and reliability under different environments. Therefore, the proposed configurable RO PUF is suitable to establish a key extraction mechanism in a WSN. PMID:28914756

An Anti-Electromagnetic Attack PUF Based on a Configurable Ring Oscillator for Wireless Sensor Networks.

PubMed

Lu, Zhaojun; Li, Dongfang; Liu, Hailong; Gong, Mingyang; Liu, Zhenglin

2017-09-15

Wireless sensor networks (WSNs) are an emerging technology employed in some crucial applications. However, limited resources and physical exposure to attackers make security a challenging issue for a WSN. Ring oscillator-based physical unclonable function (RO PUF) is a potential option to protect the security of sensor nodes because it is able to generate random responses efficiently for a key extraction mechanism, which prevents the non-volatile memory from storing secret keys. In order to deploy RO PUF in a WSN, hardware efficiency, randomness, uniqueness, and reliability should be taken into account. Besides, the resistance to electromagnetic (EM) analysis attack is important to guarantee the security of RO PUF itself. In this paper, we propose a novel architecture of configurable RO PUF based on exclusive-or (XOR) gates. First, it dramatically increases the hardware efficiency compared with other types of RO PUFs. Second, it mitigates the vulnerability to EM analysis attack by placing the adjacent RO arrays in accordance with the cosine wave and sine wave so that the frequency of each RO cannot be detected. We implement our proposal in XINLINX A-7 field programmable gate arrays (FPGAs) and conduct a set of experiments to evaluate the quality of the responses. The results show that responses pass the National Institute of Standards and Technology (NIST) statistical test and have good uniqueness and reliability under different environments. Therefore, the proposed configurable RO PUF is suitable to establish a key extraction mechanism in a WSN.

Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations.

PubMed

Brubaker, Chad; Jana, Suman; Ray, Baishakhi; Khurshid, Sarfraz; Shmatikov, Vitaly

2014-01-01

Modern network security rests on the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. Distributed systems, mobile and desktop applications, embedded devices, and all of secure Web rely on SSL/TLS for protection against network attacks. This protection critically depends on whether SSL/TLS clients correctly validate X.509 certificates presented by servers during the SSL/TLS handshake protocol. We design, implement, and apply the first methodology for large-scale testing of certificate validation logic in SSL/TLS implementations. Our first ingredient is "frankencerts," synthetic certificates that are randomly mutated from parts of real certificates and thus include unusual combinations of extensions and constraints. Our second ingredient is differential testing: if one SSL/TLS implementation accepts a certificate while another rejects the same certificate, we use the discrepancy as an oracle for finding flaws in individual implementations. Differential testing with frankencerts uncovered 208 discrepancies between popular SSL/TLS implementations such as OpenSSL, NSS, CyaSSL, GnuTLS, PolarSSL, MatrixSSL, etc. Many of them are caused by serious security vulnerabilities. For example, any server with a valid X.509 version 1 certificate can act as a rogue certificate authority and issue fake certificates for any domain, enabling man-in-the-middle attacks against MatrixSSL and GnuTLS. Several implementations also accept certificate authorities created by unauthorized issuers, as well as certificates not intended for server authentication. We also found serious vulnerabilities in how users are warned about certificate validation errors. When presented with an expired, self-signed certificate, NSS, Safari, and Chrome (on Linux) report that the certificate has expired-a low-risk, often ignored error-but not that the connection is insecure against a man-in-the-middle attack. These results demonstrate that automated adversarial testing with frankencerts is a powerful methodology for discovering security flaws in SSL/TLS implementations.

Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations

PubMed Central

Brubaker, Chad; Jana, Suman; Ray, Baishakhi; Khurshid, Sarfraz; Shmatikov, Vitaly

2014-01-01

Modern network security rests on the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. Distributed systems, mobile and desktop applications, embedded devices, and all of secure Web rely on SSL/TLS for protection against network attacks. This protection critically depends on whether SSL/TLS clients correctly validate X.509 certificates presented by servers during the SSL/TLS handshake protocol. We design, implement, and apply the first methodology for large-scale testing of certificate validation logic in SSL/TLS implementations. Our first ingredient is “frankencerts,” synthetic certificates that are randomly mutated from parts of real certificates and thus include unusual combinations of extensions and constraints. Our second ingredient is differential testing: if one SSL/TLS implementation accepts a certificate while another rejects the same certificate, we use the discrepancy as an oracle for finding flaws in individual implementations. Differential testing with frankencerts uncovered 208 discrepancies between popular SSL/TLS implementations such as OpenSSL, NSS, CyaSSL, GnuTLS, PolarSSL, MatrixSSL, etc. Many of them are caused by serious security vulnerabilities. For example, any server with a valid X.509 version 1 certificate can act as a rogue certificate authority and issue fake certificates for any domain, enabling man-in-the-middle attacks against MatrixSSL and GnuTLS. Several implementations also accept certificate authorities created by unauthorized issuers, as well as certificates not intended for server authentication. We also found serious vulnerabilities in how users are warned about certificate validation errors. When presented with an expired, self-signed certificate, NSS, Safari, and Chrome (on Linux) report that the certificate has expired—a low-risk, often ignored error—but not that the connection is insecure against a man-in-the-middle attack. These results demonstrate that automated adversarial testing with frankencerts is a powerful methodology for discovering security flaws in SSL/TLS implementations. PMID:25404868

75 FR 1093 - Self-Regulatory Organizations; The Options Clearing Corporation; Notice of Filing of Proposed...

Federal Register 2010, 2011, 2012, 2013, 2014

2010-01-08

... any option or any futures contracts on ETFS Physical Swiss Gold Shares and ETFS Physical Silver Shares... jurisdictional status of options or security futures on ETFS Physical Swiss Gold Shares or ETFS Physical Silver... approving a proposed rule change clarifying that options and securities futures on SPDR Gold Shares are...

21 CFR 1301.72 - Physical security controls for non-practitioners; narcotic treatment programs and compounders for...

Code of Federal Regulations, 2011 CFR

2011-04-01

... 21 Food and Drugs 9 2011-04-01 2011-04-01 false Physical security controls for non-practitioners... security controls for non-practitioners; narcotic treatment programs and compounders for narcotic treatment... shall have the following specifications or the equivalent: 30 man-minutes against surreptitious entry...

21 CFR 1301.72 - Physical security controls for non-practitioners; narcotic treatment programs and compounders for...

Code of Federal Regulations, 2012 CFR

2012-04-01

... 21 Food and Drugs 9 2012-04-01 2012-04-01 false Physical security controls for non-practitioners... security controls for non-practitioners; narcotic treatment programs and compounders for narcotic treatment... shall have the following specifications or the equivalent: 30 man-minutes against surreptitious entry...

21 CFR 1301.72 - Physical security controls for non-practitioners; narcotic treatment programs and compounders for...

Code of Federal Regulations, 2010 CFR

2010-04-01

... 21 Food and Drugs 9 2010-04-01 2010-04-01 false Physical security controls for non-practitioners... security controls for non-practitioners; narcotic treatment programs and compounders for narcotic treatment... shall have the following specifications or the equivalent: 30 man-minutes against surreptitious entry...

21 CFR 1301.72 - Physical security controls for non-practitioners; narcotic treatment programs and compounders for...

Code of Federal Regulations, 2013 CFR

2013-04-01

... 21 Food and Drugs 9 2013-04-01 2013-04-01 false Physical security controls for non-practitioners... security controls for non-practitioners; narcotic treatment programs and compounders for narcotic treatment... shall have the following specifications or the equivalent: 30 man-minutes against surreptitious entry...

Global water risks and national security: Building resilience (Invited)

NASA Astrophysics Data System (ADS)

Pulwarty, R. S.

2013-12-01

The UN defines water security as the capacity of a population to safeguard sustainable access to adequate quantities of acceptable quality water for sustaining livelihoods, human well-being, and socio-economic development, for ensuring protection against water-borne pollution and water-related disasters, and for preserving ecosystems in a climate of peace and political stability. This definition highlights complex and interconnected challenges and underscores the centrality of water for environmental services and human aactivities. Global risks are expressed at the national level. The 2010 Quadrennial Defense Review and the 2010 National Security Strategy identify climate change as likely to trigger outcomes that will threaten U.S. security including how freshwater resources can become a security issue. Impacts will be felt on the National Security interest through water, food and energy security, and critical infrastructure. This recognition focuses the need to consider the rates of change in climate extremes, in the context of more traditional political, economic, and social indicators that inform security analyses. There is a long-standing academic debate over the extent to which resource constraints and environmental challenges lead to inter-state conflict. It is generally recognized that water resources as a security issue to date exists mainly at the substate level and has not led to physical conflict between nation states. In conflict and disaster zones, threats to water security increase through inequitable and difficult access to water supply and related services, which may aggravate existing social fragility, tensions, violence, and conflict. This paper will (1) Outline the dimensions of water security and its links to national security (2) Analyze water footprints and management risks for key basins in the US and around the world, (3) map the link between global water security and national concerns, drawing lessons from the drought of 2012 and elsewhere, and (3) Identify preventable risks, public leadership and private innovation needed for developing adaptive water resource management institutions that take advantage of climate and hydrologic information and changes. The presentation will conclude with a preliminary framework for assessing and implementing water security measures given insecure conditions introduced by a changing climate and in the context of national security.

77 FR 749 - General Services Administration Acquisition Regulation; Implementation of Information Technology...

Federal Register 2010, 2011, 2012, 2013, 2014

2012-01-06

... Acquisition Regulation; Implementation of Information Technology Security Provision AGENCY: Office of... orders that include information technology (IT) supplies, services and systems. DATES: Effective Date... 6, 2012 that include information technology (IT) supplies, services and systems with security...

TCP/IP Implementations and Vendors Guide,

DTIC Science & Technology

1986-02-01

DOCUMENTATION PAGE la. REPORT SECURITY CLASSIFICATION lb. RESTRICTIVE MARKINGS 2a. SECURITY CLASSIFICATION AUTHORITY 3. DISTRIBUTION/ AVAILABILIT OF...UNIX System V (5.2) IMPLEMENTATION-LANGUAGE: C DISTRIBUTOR: UNIQ Digital Technologies 28 S. Water St. Batavia, fI1 60510 (312) 879-1008 CONTACT

The Virtual Desktop: Options and Challenges in Selecting a Secure Desktop Infrastructure Based on Virtualization

DTIC Science & Technology

2011-10-01

Fortunately, some products offer centralized management and deployment tools for local desktop implementation . Figure 5 illustrates the... implementation of a secure desktop infrastructure based on virtualization. It includes an overview of desktop virtualization, including an in-depth...environment in the data centre, whereas LHVD places it on the endpoint itself. Desktop virtualization implementation considerations and potential

32 CFR 2103.51 - Information Security Oversight Committee.

Code of Federal Regulations, 2011 CFR

2011-07-01

... 32 National Defense 6 2011-07-01 2011-07-01 false Information Security Oversight Committee. 2103... BE DECLASSIFIED Implementation and Review § 2103.51 Information Security Oversight Committee. The NCS Information Security Oversight Committee shall be chaired by the Staff Counsel of the National Security...

32 CFR 2103.51 - Information Security Oversight Committee.

Code of Federal Regulations, 2010 CFR

2010-07-01

... 32 National Defense 6 2010-07-01 2010-07-01 false Information Security Oversight Committee. 2103... BE DECLASSIFIED Implementation and Review § 2103.51 Information Security Oversight Committee. The NCS Information Security Oversight Committee shall be chaired by the Staff Counsel of the National Security...

Making Our Buildings Safer: Security Management and Equipment Issues.

ERIC Educational Resources Information Center

Clark, James H.

1997-01-01

Discusses three major components of library security: physical security of the environment; operating procedures for library staff, the public, and security personnel; and a contract security force (or campus security in academic institutions.) Topics include risk management; maintenance; appropriate technology, including security systems and…

Physical layer security in fiber-optic MIMO-SDM systems: An overview

NASA Astrophysics Data System (ADS)

Guan, Kyle; Cho, Junho; Winzer, Peter J.

2018-02-01

Fiber-optic transmission systems provide large capacities over enormous distances but are vulnerable to simple eavesdropping attacks at the physical layer. We classify key-based and keyless encryption and physical layer security techniques and discuss them in the context of optical multiple-input-multiple-output space-division multiplexed (MIMO-SDM) fiber-optic communication systems. We show that MIMO-SDM not only increases system capacity, but also ensures the confidentiality of information transmission. Based on recent numerical and experimental results, we review how the unique channel characteristics of MIMO-SDM can be exploited to provide various levels of physical layer security.

Nevada National Security Site Environmental Report 2012 Attachment A: Site Description

DOE Office of Scientific and Technical Information (OSTI.GOV)

Wills, Cathy A

This attachment expands on the general description of the Nevada National Security Site (NNSS) presented in the Introduction to the Nevada National Security Site Environmental Report 2012 (National Security Technologies, LLC [NSTec], 2013). Included are subsections that summarize the site’s geological, hydrological, climatological, and ecological setting and the cultural resources of the NNSS. The subsections are meant to aid the reader in understanding the complex physical and biological environment of the NNSS. An adequate knowledge of the site’s environment is necessary to assess the environmental impacts of new projects, design and implement environmental monitoring activities for current site operations, andmore » assess the impacts of site operations on the public residing in the vicinity of the NNSS. The NNSS environment contributes to several key features of the site that afford protection to the inhabitants of adjacent areas from potential exposure to radioactivity or other contaminants resulting from NNSS operations. These key features include the general remote location of the NNSS, restricted access, extended wind transport times, the great depths to slow-moving groundwater, little or no surface water, and low population density. This attachment complements the annual summary of monitoring program activities and dose assessments presented in the main body of this report.« less

Nevada National Security Site Environmental Report 2016, Attachment A: Site Description

DOE Office of Scientific and Technical Information (OSTI.GOV)

Wills, Cathy

This attachment expands on the general description of the Nevada National Security Site (NNSS) presented in the Introduction to the Nevada National Security Site Environmental Report 2016 (prepared by National Security Technologies, LLC [NSTec], 2017). Included are subsections that summarize the site’s geological, hydrological, climatological, and ecological settings and the cultural resources of the NNSS. The subsections are meant to aid the reader in understanding the complex physical and biological environment of the NNSS. An adequate knowledge of the site’s environment is necessary to assess the environmental impacts of new projects, design and implement environmental monitoring activities for current sitemore » operations, and assess the impacts of site operations on the public residing in the vicinity of the NNSS. The NNSS environment contributes to several key features of the site that afford protection to the inhabitants of adjacent areas from potential exposure to radioactivity or other contaminants resulting from NNSS operations. These key features include the general remote location of the NNSS, restricted access, extended wind transport times, the great depths to slow-moving groundwater, little or no surface water, and low population density. This attachment complements the annual summary of monitoring program activities and dose assessments presented in the main body of this report.« less

Nevada National Security Site Environmental Report 2013 Attachment A: Site Description

DOE Office of Scientific and Technical Information (OSTI.GOV)

Wills, C.

This attachment expands on the general description of the Nevada National Security Site (NNSS) presented in the Introduction to the Nevada National Security Site Environmental Report 2012 (National Security Technologies, LLC [NSTec], 2013). Included are subsections that summarize the site’s geological, hydrological, climatological, and ecological setting and the cultural resources of the NNSS. The subsections are meant to aid the reader in understanding the complex physical and biological environment of the NNSS. An adequate knowledge of the site’s environment is necessary to assess the environmental impacts of new projects, design and implement environmental monitoring activities for current site operations, andmore » assess the impacts of site operations on the public residing in the vicinity of the NNSS. The NNSS environment contributes to several key features of the site that afford protection to the inhabitants of adjacent areas from potential exposure to radioactivity or other contaminants resulting from NNSS operations. These key features include the general remote location of the NNSS, restricted access, extended wind transport times, the great depths to slow-moving groundwater, little or no surface water, and low population density. This attachment complements the annual summary of monitoring program activities and dose assessments presented in the main body of this report.« less

14 CFR 1203.202 - Responsibilities.

Code of Federal Regulations, 2011 CFR

2011-01-01

... Aeronautics and Space NATIONAL AERONAUTICS AND SPACE ADMINISTRATION INFORMATION SECURITY PROGRAM NASA Information Security Program § 1203.202 Responsibilities. (a) The Chairperson, NASA Information Security...) Ensuring effective compliance with and implementation of “the Order” and the Information Security Oversight...

14 CFR 1203.202 - Responsibilities.

Code of Federal Regulations, 2010 CFR

2010-01-01

... Aeronautics and Space NATIONAL AERONAUTICS AND SPACE ADMINISTRATION INFORMATION SECURITY PROGRAM NASA Information Security Program § 1203.202 Responsibilities. (a) The Chairperson, NASA Information Security...) Ensuring effective compliance with and implementation of “the Order” and the Information Security Oversight...

45 CFR 164.304 - Definitions.

Code of Federal Regulations, 2013 CFR

2013-10-01

... SECURITY AND PRIVACY Security Standards for the Protection of Electronic Protected Health Information § 164... and procedures, to manage the selection, development, implementation, and maintenance of security...'s or business associate's workforce in relation to the protection of that information...

45 CFR 164.304 - Definitions.

Code of Federal Regulations, 2010 CFR

2010-10-01

... SECURITY AND PRIVACY Security Standards for the Protection of Electronic Protected Health Information § 164... and procedures, to manage the selection, development, implementation, and maintenance of security...'s workforce in relation to the protection of that information. Authentication means the...

45 CFR 164.304 - Definitions.

Code of Federal Regulations, 2012 CFR

2012-10-01

... SECURITY AND PRIVACY Security Standards for the Protection of Electronic Protected Health Information § 164... and procedures, to manage the selection, development, implementation, and maintenance of security...'s workforce in relation to the protection of that information. Authentication means the...

45 CFR 164.304 - Definitions.

Code of Federal Regulations, 2011 CFR

2011-10-01

... SECURITY AND PRIVACY Security Standards for the Protection of Electronic Protected Health Information § 164... and procedures, to manage the selection, development, implementation, and maintenance of security...'s workforce in relation to the protection of that information. Authentication means the...

45 CFR 164.304 - Definitions.

Code of Federal Regulations, 2014 CFR

2014-10-01

... SECURITY AND PRIVACY Security Standards for the Protection of Electronic Protected Health Information § 164... and procedures, to manage the selection, development, implementation, and maintenance of security...'s or business associate's workforce in relation to the protection of that information...

Firefighter health and fitness assessment: a call to action.

PubMed

Storer, Thomas W; Dolezal, Brett A; Abrazado, Marlon L; Smith, Denise L; Batalin, Maxim A; Tseng, Chi-Hong; Cooper, Christopher B

2014-03-01

Sudden cardiac deaths experienced by firefighters in the line of duty account for the largest proportion of deaths annually. Several fire service standards for fitness and wellness have been recommended but currently only 30% of U.S. fire departments are implementing programs for this purpose. The Department of Homeland Security Science and Technology Directorate has initiated the Physiological Health Assessment System for Emergency Responders (PHASER) program aiming to reduce these line-of-duty deaths through an integration of medical science and sensor technologies. Confirming previous reports, PHASER comprehensive risk assessment has identified lack of physical fitness with propensity for overexertion as a major modifiable risk factor. We sought to determine if current levels of fitness and cardiovascular disease (CVD) risk factors in a contemporary cohort of firefighters were better than those reported over the past 30 years. Fifty-one firefighters from a Southern California department were characterized for physical fitness and CVD risk factors using standard measures. Overall, physical fitness and risk factors were not different from previous reports of firefighter fitness and most subjects did not achieve recommended fitness standards. Considering the lack of widespread implementation of wellness/fitness programs in the U.S. fire service together with our findings that low physical fitness and the presence of CVD risk factors persist, we issue a call to action among health and fitness professionals to assist the fire service in implementing programs for firefighters that improve fitness and reduce CVD risk factors. Fitness professionals should be empowered to work with fire departments lending their expertise to guide programs that achieve these objectives, which may then lead to reduced incidence of sudden cardiac death or stroke.

DICOM image secure communications with Internet protocols IPv6 and IPv4.

PubMed

Zhang, Jianguo; Yu, Fenghai; Sun, Jianyong; Yang, Yuanyuan; Liang, Chenwen

2007-01-01

Image-data transmission from one site to another through public network is usually characterized in term of privacy, authenticity, and integrity. In this paper, we first describe a general scenario about how image is delivered from one site to another through a wide-area network (WAN) with security features of data privacy, integrity, and authenticity. Second, we give the common implementation method of the digital imaging and communication in medicine (DICOM) image communication software library with IPv6/IPv4 for high-speed broadband Internet by using open-source software. Third, we discuss two major security-transmission methods, the IP security (IPSec) and the secure-socket layer (SSL) or transport-layer security (TLS), being used currently in medical-image-data communication with privacy support. Fourth, we describe a test schema of multiple-modality DICOM-image communications through TCP/IPv4 and TCP/IPv6 with different security methods, different security algorithms, and operating systems, and evaluate the test results. We found that there are tradeoff factors between choosing the IPsec and the SSL/TLS-based security implementation of IPv6/IPv4 protocols. If the WAN networks only use IPv6 such as in high-speed broadband Internet, the choice is IPsec-based security. If the networks are IPv4 or the combination of IPv6 and IPv4, it is better to use SSL/TLS security. The Linux platform has more security algorithms implemented than the Windows (XP) platform, and can achieve better performance in most experiments of IPv6 and IPv4-based DICOM-image communications. In teleradiology or enterprise-PACS applications, the Linux operating system may be the better choice as peer security gateways for both the IPsec and the SSL/TLS-based secure DICOM communications cross public networks.

Canine Supply for Physical Security: An Analysis of the Royal Australian Air Force Military Working Dog Program

DTIC Science & Technology

2016-03-01

PHYSICAL SECURITY: AN ANALYSIS OF THE ROYAL AUSTRALIAN AIR FORCE MILITARY WORKING DOG PROGRAM by Mark W. Powell March 2016 Thesis...AN ANALYSIS OF THE ROYAL AUSTRALIAN AIR FORCE MILITARY WORKING DOG PROGRAM 5. FUNDING NUMBERS 6. AUTHOR(S) Mark W. Powell 7. PERFORMING...increased demand on its physical security elements. Its military working dog (MWD) workforce is required to meet an inventory of 204 by end of year 2023 as

12 CFR 605.501 - Information Security Officer.

Code of Federal Regulations, 2011 CFR

2011-01-01

... 12 Banks and Banking 6 2011-01-01 2011-01-01 false Information Security Officer. 605.501 Section... Information Security Officer. (a) The Information Security Officer of the Farm Credit Administration shall be responsible for implementation and oversight of the information security program and procedures adopted by the...

12 CFR 605.501 - Information Security Officer.

Code of Federal Regulations, 2010 CFR

2010-01-01

... 12 Banks and Banking 6 2010-01-01 2010-01-01 false Information Security Officer. 605.501 Section... Information Security Officer. (a) The Information Security Officer of the Farm Credit Administration shall be responsible for implementation and oversight of the information security program and procedures adopted by the...

14 CFR 129.28 - Flightdeck security.

Code of Federal Regulations, 2012 CFR

2012-01-01

... 14 Aeronautics and Space 3 2012-01-01 2012-01-01 false Flightdeck security. 129.28 Section 129.28... Flightdeck security. (a) After August 20, 2002, except for a newly manufactured airplane on a non-revenue...; or the operator must implement a security program approved by the Transportation Security...

14 CFR 129.28 - Flightdeck security.

Code of Federal Regulations, 2014 CFR

2014-01-01

... 14 Aeronautics and Space 3 2014-01-01 2014-01-01 false Flightdeck security. 129.28 Section 129.28... Flightdeck security. (a) After August 20, 2002, except for a newly manufactured airplane on a non-revenue...; or the operator must implement a security program approved by the Transportation Security...

14 CFR 129.28 - Flightdeck security.

Code of Federal Regulations, 2010 CFR

2010-01-01

... 14 Aeronautics and Space 3 2010-01-01 2010-01-01 false Flightdeck security. 129.28 Section 129.28... Flightdeck security. (a) After August 20, 2002, except for a newly manufactured airplane on a non-revenue...; or the operator must implement a security program approved by the Transportation Security...

Facilitating and securing offline e-medicine service through image steganography.

PubMed

Kamal, A H M; Islam, M Mahfuzul

2014-06-01

E-medicine is a process to provide health care services to people using the Internet or any networking technology. In this Letter, a new idea is proposed to model the physical structure of the e-medicine system to better provide offline health care services. Smart cards are used to authenticate the user singly. A very unique technique is also suggested to verify the card owner's identity and to embed secret data to the card while providing patients' reports either at booths or at the e-medicine server system. The simulation results of card authentication and embedding procedure justify the proposed implementation.

Protecting water and wastewater infrastructure from cyber attacks

NASA Astrophysics Data System (ADS)

Panguluri, Srinivas; Phillips, William; Cusimano, John

2011-12-01

Multiple organizations over the years have collected and analyzed data on cyber attacks and they all agree on one conclusion: cyber attacks are real and can cause significant damages. This paper presents some recent statistics on cyber attacks and resulting damages. Water and wastewater utilities must adopt countermeasures to prevent or minimize the damage in case of such attacks. Many unique challenges are faced by the water and wastewater industry while selecting and implementing security countermeasures; the key challenges are: 1) the increasing interconnection of their business and control system networks, 2) large variation of proprietary industrial control equipment utilized, 3) multitude of cross-sector cyber-security standards, and 4) the differences in the equipment vendor's approaches to meet these security standards. The utilities can meet these challenges by voluntarily selecting and adopting security standards, conducting a gap analysis, performing vulnerability/risk analysis, and undertaking countermeasures that best meets their security and organizational requirements. Utilities should optimally utilize their limited resources to prepare and implement necessary programs that are designed to increase cyber-security over the years. Implementing cyber security does not necessarily have to be expensive, substantial improvements can be accomplished through policy, procedure, training and awareness. Utilities can also get creative and allocate more funding through annual budgets and reduce dependence upon capital improvement programs to achieve improvements in cyber-security.

49 CFR 1549.3 - TSA inspection authority.

Code of Federal Regulations, 2012 CFR

2012-10-01

...) Oversee the implementation, and ensure the adequacy, of security measures at airports and other... Transportation Other Regulations Relating to Transportation (Continued) TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF HOMELAND SECURITY CIVIL AVIATION SECURITY CERTIFIED CARGO SCREENING PROGRAM General § 1549.3...

49 CFR 1549.3 - TSA inspection authority.

Code of Federal Regulations, 2011 CFR

2011-10-01

...) Oversee the implementation, and ensure the adequacy, of security measures at airports and other... Transportation Other Regulations Relating to Transportation (Continued) TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF HOMELAND SECURITY CIVIL AVIATION SECURITY CERTIFIED CARGO SCREENING PROGRAM General § 1549.3...

49 CFR 1549.3 - TSA inspection authority.

Code of Federal Regulations, 2013 CFR

2013-10-01

...) Oversee the implementation, and ensure the adequacy, of security measures at airports and other... Transportation Other Regulations Relating to Transportation (Continued) TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF HOMELAND SECURITY CIVIL AVIATION SECURITY CERTIFIED CARGO SCREENING PROGRAM General § 1549.3...

49 CFR 1549.3 - TSA inspection authority.

Code of Federal Regulations, 2014 CFR

2014-10-01

...) Oversee the implementation, and ensure the adequacy, of security measures at airports and other... Transportation Other Regulations Relating to Transportation (Continued) TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF HOMELAND SECURITY CIVIL AVIATION SECURITY CERTIFIED CARGO SCREENING PROGRAM General § 1549.3...

76 FR 23513 - Public and Closed Meeting To Discuss Comments on Draft Regulatory Basis for Rulemaking Revising...

Federal Register 2010, 2011, 2012, 2013, 2014

2011-04-27

..., ``Security Performance (Adversary) Characteristics for Physical Security Programs for 10 CFR [Title 10 of the..., ``Physical Protection of Plants and Materials,'' that would apply during the storage of SNF at an ISFSI and... facilities licensed to store SNF through a combination of these existing security regulations and the...

Privacy and Security: A Bibliography.

ERIC Educational Resources Information Center

Computer and Business Equipment Manufacturers Association, Washington, DC.

Compiled at random from many sources, this bibliography attempts to cite as many publications concerning privacy and security as are available. The entries are organized under seven headings: (1) systems security, technical security, clearance of personnel, (2) corporate physical security, (3) administrative security, (4) miscellaneous--privacy…

Process Security in Chemical Engineering Education

ERIC Educational Resources Information Center

Piluso, Cristina; Uygun, Korkut; Huang, Yinlun; Lou, Helen H.

2005-01-01

The threats of terrorism have greatly alerted the chemical process industries to assure plant security at all levels: infrastructure-improvement-focused physical security, information-protection-focused cyber security, and design-and-operation-improvement-focused process security. While developing effective plant security methods and technologies…

Secure Cloud Computing Implementation Study For Singapore Military Operations

DTIC Science & Technology

2016-09-01

COMPUTING IMPLEMENTATION STUDY FOR SINGAPORE MILITARY OPERATIONS by Lai Guoquan September 2016 Thesis Advisor: John D. Fulp Co-Advisor...DATES COVERED Master’s thesis 4. TITLE AND SUBTITLE SECURE CLOUD COMPUTING IMPLEMENTATION STUDY FOR SINGAPORE MILITARY OPERATIONS 5. FUNDING NUMBERS...addition, from the military perspective, the benefits of cloud computing were analyzed from a study of the U.S. Department of Defense. Then, using

42 CFR 73.11 - Security.

Code of Federal Regulations, 2012 CFR

2012-10-01

... 42 Public Health 1 2012-10-01 2012-10-01 false Security. 73.11 Section 73.11 Public Health PUBLIC... AND TOXINS § 73.11 Security. (a) An individual or entity required to register under this part must develop and implement a written security plan. The security plan must be sufficient to safeguard the...

9 CFR 121.11 - Security.

Code of Federal Regulations, 2011 CFR

2011-01-01

... 9 Animals and Animal Products 1 2011-01-01 2011-01-01 false Security. 121.11 Section 121.11... AGENTS AND TOXINS § 121.11 Security. (a) An individual or entity required to register under this part must develop and implement a written security plan. The security plan must be sufficient to safeguard...

9 CFR 121.11 - Security.

Code of Federal Regulations, 2012 CFR

2012-01-01

... 9 Animals and Animal Products 1 2012-01-01 2012-01-01 false Security. 121.11 Section 121.11... AGENTS AND TOXINS § 121.11 Security. (a) An individual or entity required to register under this part must develop and implement a written security plan. The security plan must be sufficient to safeguard...

42 CFR 73.11 - Security.

Code of Federal Regulations, 2011 CFR

2011-10-01

... 42 Public Health 1 2011-10-01 2011-10-01 false Security. 73.11 Section 73.11 Public Health PUBLIC... AND TOXINS § 73.11 Security. (a) An individual or entity required to register under this part must develop and implement a written security plan. The security plan must be sufficient to safeguard the...

7 CFR 331.11 - Security.

Code of Federal Regulations, 2013 CFR

2013-01-01

... 7 Agriculture 5 2013-01-01 2013-01-01 false Security. 331.11 Section 331.11 Agriculture..., DEPARTMENT OF AGRICULTURE POSSESSION, USE, AND TRANSFER OF SELECT AGENTS AND TOXINS § 331.11 Security. Link... register under this part must develop and implement a written security plan. The security plan must be...

42 CFR 73.11 - Security.

Code of Federal Regulations, 2014 CFR

2014-10-01

... 42 Public Health 1 2014-10-01 2014-10-01 false Security. 73.11 Section 73.11 Public Health PUBLIC... AND TOXINS § 73.11 Security. (a) An individual or entity required to register under this part must develop and implement a written security plan. The security plan must be sufficient to safeguard the...

42 CFR 73.11 - Security.

Code of Federal Regulations, 2013 CFR

2013-10-01

... 42 Public Health 1 2013-10-01 2013-10-01 false Security. 73.11 Section 73.11 Public Health PUBLIC... AND TOXINS § 73.11 Security. (a) An individual or entity required to register under this part must develop and implement a written security plan. The security plan must be sufficient to safeguard the...

9 CFR 121.11 - Security.

Code of Federal Regulations, 2014 CFR

2014-01-01

... 9 Animals and Animal Products 1 2014-01-01 2014-01-01 false Security. 121.11 Section 121.11... AGENTS AND TOXINS § 121.11 Security. (a) An individual or entity required to register under this part must develop and implement a written security plan. The security plan must be sufficient to safeguard...

9 CFR 121.11 - Security.

Code of Federal Regulations, 2013 CFR

2013-01-01

... 9 Animals and Animal Products 1 2013-01-01 2013-01-01 false Security. 121.11 Section 121.11... AGENTS AND TOXINS § 121.11 Security. (a) An individual or entity required to register under this part must develop and implement a written security plan. The security plan must be sufficient to safeguard...

A Security Checklist for ERP Implementations

ERIC Educational Resources Information Center

Hughes, Joy R.; Beer, Robert

2007-01-01

The EDUCAUSE/Internet2 Computer and Network Security Task Force consulted with IT security professionals on campus about concerns with the current state of security in enterprise resource planning (ERP) systems. From these conversations, it was clear that security issues generally fell into one of two areas: (1) It has become extremely difficult…

An Examination of an Information Security Framework Implementation Based on Agile Values to Achieve Health Insurance Portability and Accountability Act Security Rule Compliance in an Academic Medical Center: The Thomas Jefferson University Case Study

ERIC Educational Resources Information Center

Reis, David W.

2012-01-01

Agile project management is most often examined in relation to software development, while information security frameworks are often examined with respect to certain risk management capabilities rather than in terms of successful implementation approaches. This dissertation extended the study of both Agile project management and information…

The Physical Layer Security Experiments of Cooperative Communication System with Different Relay Behaviors.

PubMed

Su, Yishan; Han, Guangyao; Fu, Xiaomei; Xu, Naishen; Jin, Zhigang

2017-04-06

Physical layer security is an attractive security mechanism, which exploits the randomness characteristics of wireless transmission channel to achieve security. However, it is hampered by the limitation of the channel condition that the main channel must be better than the eavesdropper channel. To alleviate the limitation, cooperative communication is introduced. Few studies have investigated the physical layer security of the relay transmission model. In this paper, we performed some experiments to evaluate the physical layer security of a cooperative communication system, with a relay operating in decode-and-forward (DF) cooperative mode, selfish and malicious behavior in real non-ideal transmission environment. Security performance is evaluated in terms of the probability of non-zero secrecy capacity. Experiments showed some different results compared to theoretical simulation: (1) to achieve the maximum secrecy capacity, the optimal relay power according to the experiments result is larger than that of ideal theoretical results under both cooperative and selfish behavior relay; (2) the relay in malicious behavior who forwards noise to deteriorate the main channel may deteriorate the eavesdropper channel more seriously than the main channel; (3) the optimal relay positions under cooperative and selfish behavior relay cases are both located near the destination because of non-ideal transmission.

A Quantitative Study on the Relationship of Information Security Policy Awareness, Enforcement, and Maintenance to Information Security Program Effectiveness

ERIC Educational Resources Information Center

Francois, Michael T.

2016-01-01

Today's organizations rely heavily on information technology to conduct their daily activities. Therefore, their information security systems are an area of heightened security concern. As a result, organizations implement information security programs to address and mitigate that concern. However, even with the emphasis on information security,…

Maritime security : progress made in implementing Maritime Transportation Security Act, but concerns remain : statement of Margaret Wrightson, Director, Homeland Security and Justice Issues

DOT National Transportation Integrated Search

2003-09-09

After the events of September 11, 2001, concerns were raised over the security of U.S. ports and waterways. In response to the concerns over port security, Congress passed the Maritime Transportation Security Act in November 2002. The act created a b...

14 CFR 460.53 - Security.

Code of Federal Regulations, 2013 CFR

2013-01-01

... 14 Aeronautics and Space 4 2013-01-01 2013-01-01 false Security. 460.53 Section 460.53 Aeronautics and Space COMMERCIAL SPACE TRANSPORTATION, FEDERAL AVIATION ADMINISTRATION, DEPARTMENT OF....53 Security. An operator must implement security requirements to prevent any space flight participant...

14 CFR 460.53 - Security.

Code of Federal Regulations, 2011 CFR

2011-01-01

... 14 Aeronautics and Space 4 2011-01-01 2011-01-01 false Security. 460.53 Section 460.53 Aeronautics and Space COMMERCIAL SPACE TRANSPORTATION, FEDERAL AVIATION ADMINISTRATION, DEPARTMENT OF....53 Security. An operator must implement security requirements to prevent any space flight participant...

14 CFR 460.53 - Security.

Code of Federal Regulations, 2012 CFR

2012-01-01

... 14 Aeronautics and Space 4 2012-01-01 2012-01-01 false Security. 460.53 Section 460.53 Aeronautics and Space COMMERCIAL SPACE TRANSPORTATION, FEDERAL AVIATION ADMINISTRATION, DEPARTMENT OF....53 Security. An operator must implement security requirements to prevent any space flight participant...

14 CFR 460.53 - Security.

Code of Federal Regulations, 2014 CFR

2014-01-01

... 14 Aeronautics and Space 4 2014-01-01 2014-01-01 false Security. 460.53 Section 460.53 Aeronautics and Space COMMERCIAL SPACE TRANSPORTATION, FEDERAL AVIATION ADMINISTRATION, DEPARTMENT OF....53 Security. An operator must implement security requirements to prevent any space flight participant...

14 CFR 460.53 - Security.

Code of Federal Regulations, 2010 CFR

2010-01-01

... 14 Aeronautics and Space 4 2010-01-01 2010-01-01 false Security. 460.53 Section 460.53 Aeronautics and Space COMMERCIAL SPACE TRANSPORTATION, FEDERAL AVIATION ADMINISTRATION, DEPARTMENT OF....53 Security. An operator must implement security requirements to prevent any space flight participant...

32 CFR 2400.42 - Security Officer.

Code of Federal Regulations, 2011 CFR

2011-07-01

... National Defense Other Regulations Relating to National Defense OFFICE OF SCIENCE AND TECHNOLOGY POLICY REGULATIONS TO IMPLEMENT E.O. 12356; OFFICE OF SCIENCE AND TECHNOLOGY POLICY INFORMATION SECURITY PROGRAM Office of Science and Technology Policy Information Security Program Management § 2400.42 Security...

32 CFR 2400.42 - Security Officer.

Code of Federal Regulations, 2010 CFR

2010-07-01

... National Defense Other Regulations Relating to National Defense OFFICE OF SCIENCE AND TECHNOLOGY POLICY REGULATIONS TO IMPLEMENT E.O. 12356; OFFICE OF SCIENCE AND TECHNOLOGY POLICY INFORMATION SECURITY PROGRAM Office of Science and Technology Policy Information Security Program Management § 2400.42 Security...

32 CFR 2400.42 - Security Officer.

Code of Federal Regulations, 2014 CFR

2014-07-01

... National Defense Other Regulations Relating to National Defense OFFICE OF SCIENCE AND TECHNOLOGY POLICY REGULATIONS TO IMPLEMENT E.O. 12356; OFFICE OF SCIENCE AND TECHNOLOGY POLICY INFORMATION SECURITY PROGRAM Office of Science and Technology Policy Information Security Program Management § 2400.42 Security...

32 CFR 2400.42 - Security Officer.

Code of Federal Regulations, 2013 CFR

2013-07-01

... National Defense Other Regulations Relating to National Defense OFFICE OF SCIENCE AND TECHNOLOGY POLICY REGULATIONS TO IMPLEMENT E.O. 12356; OFFICE OF SCIENCE AND TECHNOLOGY POLICY INFORMATION SECURITY PROGRAM Office of Science and Technology Policy Information Security Program Management § 2400.42 Security...

32 CFR 2400.42 - Security Officer.

Code of Federal Regulations, 2012 CFR

2012-07-01

... National Defense Other Regulations Relating to National Defense OFFICE OF SCIENCE AND TECHNOLOGY POLICY REGULATIONS TO IMPLEMENT E.O. 12356; OFFICE OF SCIENCE AND TECHNOLOGY POLICY INFORMATION SECURITY PROGRAM Office of Science and Technology Policy Information Security Program Management § 2400.42 Security...

Report: Information Security Series: Security Practices Comprehensive Environmental Response, Compensation, and Liability Information System

EPA Pesticide Factsheets

Report #2006-P-00019, March 28, 2006. OSWER’s implemented practices to ensure production servers were being monitored for known vulnerabilities and personnel with significant security responsibility completed the Agency’s recommended security training.

42 CFR 3.106 - Security requirements.

Code of Federal Regulations, 2012 CFR

2012-10-01

..., maintenance, storage, removal, disclosure, transmission and destruction. (b) Security framework. A PSO must... subsection. In addressing the framework that follows, the PSO may develop appropriate and scalable security...) Security management. A PSO must address: (i) Maintenance and effective implementation of written policies...

42 CFR 3.106 - Security requirements.

Code of Federal Regulations, 2013 CFR

2013-10-01

..., maintenance, storage, removal, disclosure, transmission and destruction. (b) Security framework. A PSO must... subsection. In addressing the framework that follows, the PSO may develop appropriate and scalable security...) Security management. A PSO must address: (i) Maintenance and effective implementation of written policies...

42 CFR 3.106 - Security requirements.

Code of Federal Regulations, 2014 CFR

2014-10-01

..., maintenance, storage, removal, disclosure, transmission and destruction. (b) Security framework. A PSO must... subsection. In addressing the framework that follows, the PSO may develop appropriate and scalable security...) Security management. A PSO must address: (i) Maintenance and effective implementation of written policies...

Evaluating Common Privacy Vulnerabilities in Internet Service Providers

NASA Astrophysics Data System (ADS)

Kotzanikolaou, Panayiotis; Maniatis, Sotirios; Nikolouzou, Eugenia; Stathopoulos, Vassilios

Privacy in electronic communications receives increased attention in both research and industry forums, stemming from both the users' needs and from legal and regulatory requirements in national or international context. Privacy in internet-based communications heavily relies on the level of security of the Internet Service Providers (ISPs), as well as on the security awareness of the end users. This paper discusses the role of the ISP in the privacy of the communications. Based on real security audits performed in national-wide ISPs, we illustrate privacy-specific threats and vulnerabilities that many providers fail to address when implementing their security policies. We subsequently provide and discuss specific security measures that the ISPs can implement, in order to fine-tune their security policies in the context of privacy protection.

Continuous-variable quantum authentication of physical unclonable keys: Security against an emulation attack

NASA Astrophysics Data System (ADS)

Nikolopoulos, Georgios M.

2018-01-01

We consider a recently proposed entity authentication protocol in which a physical unclonable key is interrogated by random coherent states of light, and the quadratures of the scattered light are analyzed by means of a coarse-grained homodyne detection. We derive a sufficient condition for the protocol to be secure against an emulation attack in which an adversary knows the challenge-response properties of the key and moreover, he can access the challenges during the verification. The security analysis relies on Holevo's bound and Fano's inequality, and suggests that the protocol is secure against the emulation attack for a broad range of physical parameters that are within reach of today's technology.

3D Imaging with Structured Illumination for Advanced Security Applications

DOE Office of Scientific and Technical Information (OSTI.GOV)

Birch, Gabriel Carisle; Dagel, Amber Lynn; Kast, Brian A.

2015-09-01

Three-dimensional (3D) information in a physical security system is a highly useful dis- criminator. The two-dimensional data from an imaging systems fails to provide target dis- tance and three-dimensional motion vector, which can be used to reduce nuisance alarm rates and increase system effectiveness. However, 3D imaging devices designed primarily for use in physical security systems are uncommon. This report discusses an architecture favorable to physical security systems; an inexpensive snapshot 3D imaging system utilizing a simple illumination system. The method of acquiring 3D data, tests to understand illumination de- sign, and software modifications possible to maximize information gathering capabilitymore » are discussed.« less

Transparent Proxy for Secure E-Mail

NASA Astrophysics Data System (ADS)

Michalák, Juraj; Hudec, Ladislav

2010-05-01

The paper deals with the security of e-mail messages and e-mail server implementation by means of a transparent SMTP proxy. The security features include encryption and signing of transported messages. The goal is to design and implement a software proxy for secure e-mail including its monitoring, administration, encryption and signing keys administration. In particular, we focus on automatic public key on-the-fly encryption and signing of e-mail messages according to S/MIME standard by means of an embedded computer system whose function can be briefly described as a brouter with transparent SMTP proxy.

Emergency Response Manual

NASA Technical Reports Server (NTRS)

Barnett, Traci M.

2004-01-01

Safety and security is very important at NASA. The Security Management and Safeguards Office goal is ensure safety and security for all NASA Lewis and Plum Brook Station visitors and workers. The office protects against theft, sabotage, malicious damage, espionage, and other threats or acts of violence. There are three types of security at NASA: physical, IT, and personnel. IT is concerned with sensitive and classified information and computers. Physical security includes the officers who check visitors and workers in and patrol the facility. Personnel security is concerned with background checks during hiring. During my internship, I met people from and gained knowledge about all three types of security. I primarily worked with Dr. Richard Soppet in physical security. During my experience with physical security, I observed and worked with many aspects of it. I attended various security meetings at both NASA Lewis and Plum Brook. The meetings were about homeland security and other improvements that will be made to both facilities. I also spent time with a locksmith. The locksmith makes copies of keys and unlocks doors for people who need them. I rode around in a security vehicle with an officer as he patrolled. I also observed the officer make a search of a visitor s vehicle. All visitors vehicles are searched upon entering NASA. I spent time and observed in the dispatch office. The officer answers calls and sends out officers when needed. The officer also monitors the security cameras. My primary task was completing an emergency response manual. This manual would assist local law enforcement and fire agencies in case of an emergency. The manual has pictures and descriptions of the buildings. It also contains the information about hazards inside of the buildings. This information will be very helpul to law enforcement so that when called upon during an emergency, they will not create an even bigger problem with collateral damage.

77 FR 13206 - Protective Force Personnel Medical, Physical Readiness, Training, and Access Authorization Standards

Federal Register 2010, 2011, 2012, 2013, 2014

2012-03-06

...The Department of Energy (DOE or Department) proposes to revise the regulation governing the standards for medical, physical performance, training, and access authorizations for protective force (PF) personnel employed by contractors providing security services to the Department. The existing version of this regulation was promulgated in 1993 and substantial portions of the regulation date to the mid- 1980s. Since 1993 DOE policy has placed greater reliance upon technology, vehicular response, and increased firepower and, correspondingly, has reduced its reliance upon the ability of PF personnel to perform the running tasks required in the current regulation. Furthermore, this shift in emphasis has placed a greater premium upon the retention of mature, tactically experienced, and technically sophisticated personnel, particularly since these personnel represent a considerable investment by DOE in security background investigations and training. The proposed revisions bring DOE PF medical and physical readiness requirements in line with these tactical and organizational priorities. The proposed revisions reduce the exposure of the PF population to injuries related to physical readiness testing. They would create a PF readiness classification designed specifically to encourage the retention of experienced personnel. The revisions would further ensure that PF personnel would be evaluated on a case-by-case basis on their ability to perform the essential functions of their positions without posing a direct threat to themselves or site personnel, the facility, or the general public. The proposed revisions would further ensure that reasonable accommodations would be considered before a determination is made that an individual cannot perform the essential functions of a particular position. The proposed rule also would provide for new medical review processes for PF personnel disqualified from medical certification. The proposed rule would ensure that DOE PF medical and physical readiness requirements would be compliant with the Americans with Disabilities Act (ADA) of 1990, as amended by the Americans with Disabilities Amendment Act of 2009 (ADAAA), the Privacy Act and DOE implementing regulations, and changes in DOE policy regarding PF operations made since the publication of the last version of this rule. In addition, the proposed rule would promote operational efficiency through greater emphasis on aligning training with mission-essential tasks and the increased use of simulation technologies. Finally, the proposed revision would update the regulation to reflect organizational changes in the Office of Health, Safety and Security and the creation of the National Nuclear Security Administration (NNSA).

Scientific Openness and National Security at the National Laboratories

NASA Astrophysics Data System (ADS)

McTague, John

2000-04-01

The possible loss to the People's Republic of China of important U.S. nuclear-weapons-related information has aroused concern about interactions of scientists employed by the national laboratories with foreign nationals. As a result, the National Academies assembled a committee to examine the roles of the national laboratories, the contribution of foreign interactions to the fulfillment of those roles, the risks and benefits of scientific openness in this context, and the merits and liabilities of the specific policies being implemented or proposed with respect to contacts with foreign nationals. The committee concluded that there are many aspects of the work at the laboratories that benefit from or even demand the opportunity for foreign interactions. The committee recommended five principles for guiding policy: (1) Maintain balance. Policy governing international dialogue by laboratory staff should seek to encourage international engagement in some areas, while tightly controlling it in others. (2) Educate staff. Security procedures should be clear, easy to follow, and serve an understandable purpose. (3) Streamline procedures. Good science is compatible with good security if there is intelligent line management both at the labs and in Washington, which applies effective tools for security in a sensible fashion. (4) Focus efforts. DOE should focus its efforts governing tightened security for information. The greatest attention should obviously be provided to the protection of classified information by appropriate physical and cybersecurity measures, and by personnel procedures and training. (5) Beware of prejudice against foreigners. Over the past half-century foreign-born individuals have contributed broadly and profoundly to national security through their work at the national laboratories.

Cyber security challenges in Smart Cities: Safety, security and privacy

PubMed Central

Elmaghraby, Adel S.; Losavio, Michael M.

2014-01-01

The world is experiencing an evolution of Smart Cities. These emerge from innovations in information technology that, while they create new economic and social opportunities, pose challenges to our security and expectations of privacy. Humans are already interconnected via smart phones and gadgets. Smart energy meters, security devices and smart appliances are being used in many cities. Homes, cars, public venues and other social systems are now on their path to the full connectivity known as the “Internet of Things.” Standards are evolving for all of these potentially connected systems. They will lead to unprecedented improvements in the quality of life. To benefit from them, city infrastructures and services are changing with new interconnected systems for monitoring, control and automation. Intelligent transportation, public and private, will access a web of interconnected data from GPS location to weather and traffic updates. Integrated systems will aid public safety, emergency responders and in disaster recovery. We examine two important and entangled challenges: security and privacy. Security includes illegal access to information and attacks causing physical disruptions in service availability. As digital citizens are more and more instrumented with data available about their location and activities, privacy seems to disappear. Privacy protecting systems that gather data and trigger emergency response when needed are technological challenges that go hand-in-hand with the continuous security challenges. Their implementation is essential for a Smart City in which we would wish to live. We also present a model representing the interactions between person, servers and things. Those are the major element in the Smart City and their interactions are what we need to protect. PMID:25685517

Experimental quantum key distribution with simulated ground-to-satellite photon losses and processing limitations

NASA Astrophysics Data System (ADS)

Bourgoin, Jean-Philippe; Gigov, Nikolay; Higgins, Brendon L.; Yan, Zhizhong; Meyer-Scott, Evan; Khandani, Amir K.; Lütkenhaus, Norbert; Jennewein, Thomas

2015-11-01

Quantum key distribution (QKD) has the potential to improve communications security by offering cryptographic keys whose security relies on the fundamental properties of quantum physics. The use of a trusted quantum receiver on an orbiting satellite is the most practical near-term solution to the challenge of achieving long-distance (global-scale) QKD, currently limited to a few hundred kilometers on the ground. This scenario presents unique challenges, such as high photon losses and restricted classical data transmission and processing power due to the limitations of a typical satellite platform. Here we demonstrate the feasibility of such a system by implementing a QKD protocol, with optical transmission and full post-processing, in the high-loss regime using minimized computing hardware at the receiver. Employing weak coherent pulses with decoy states, we demonstrate the production of secure key bits at up to 56.5 dB of photon loss. We further illustrate the feasibility of a satellite uplink by generating a secure key while experimentally emulating the varying losses predicted for realistic low-Earth-orbit satellite passes at 600 km altitude. With a 76 MHz source and including finite-size analysis, we extract 3374 bits of a secure key from the best pass. We also illustrate the potential benefit of combining multiple passes together: while one suboptimal "upper-quartile" pass produces no finite-sized key with our source, the combination of three such passes allows us to extract 165 bits of a secure key. Alternatively, we find that by increasing the signal rate to 300 MHz it would be possible to extract 21 570 bits of a secure finite-sized key in just a single upper-quartile pass.

Risk assessment for physical and cyber attacks on critical infrastructures.

DOE Office of Scientific and Technical Information (OSTI.GOV)

Smith, Bryan J.; Sholander, Peter E.; Phelan, James M.

2005-08-01

Assessing the risk of malevolent attacks against large-scale critical infrastructures requires modifications to existing methodologies. Existing risk assessment methodologies consider physical security and cyber security separately. As such, they do not accurately model attacks that involve defeating both physical protection and cyber protection elements (e.g., hackers turning off alarm systems prior to forced entry). This paper presents a risk assessment methodology that accounts for both physical and cyber security. It also preserves the traditional security paradigm of detect, delay and respond, while accounting for the possibility that a facility may be able to recover from or mitigate the results ofmore » a successful attack before serious consequences occur. The methodology provides a means for ranking those assets most at risk from malevolent attacks. Because the methodology is automated the analyst can also play 'what if with mitigation measures to gain a better understanding of how to best expend resources towards securing the facilities. It is simple enough to be applied to large infrastructure facilities without developing highly complicated models. Finally, it is applicable to facilities with extensive security as well as those that are less well-protected.« less

Network Security via Biometric Recognition of Patterns of Gene Expression

NASA Technical Reports Server (NTRS)

Shaw, Harry C.

2016-01-01

Molecular biology provides the ability to implement forms of information and network security completely outside the bounds of legacy security protocols and algorithms. This paper addresses an approach which instantiates the power of gene expression for security. Molecular biology provides a rich source of gene expression and regulation mechanisms, which can be adopted to use in the information and electronic communication domains. Conventional security protocols are becoming increasingly vulnerable due to more intensive, highly capable attacks on the underlying mathematics of cryptography. Security protocols are being undermined by social engineering and substandard implementations by IT (Information Technology) organizations. Molecular biology can provide countermeasures to these weak points with the current security approaches. Future advances in instruments for analyzing assays will also enable this protocol to advance from one of cryptographic algorithms to an integrated system of cryptographic algorithms and real-time assays of gene expression products.

Network Security via Biometric Recognition of Patterns of Gene Expression

NASA Technical Reports Server (NTRS)

Shaw, Harry C.

2016-01-01

Molecular biology provides the ability to implement forms of information and network security completely outside the bounds of legacy security protocols and algorithms. This paper addresses an approach which instantiates the power of gene expression for security. Molecular biology provides a rich source of gene expression and regulation mechanisms, which can be adopted to use in the information and electronic communication domains. Conventional security protocols are becoming increasingly vulnerable due to more intensive, highly capable attacks on the underlying mathematics of cryptography. Security protocols are being undermined by social engineering and substandard implementations by IT organizations. Molecular biology can provide countermeasures to these weak points with the current security approaches. Future advances in instruments for analyzing assays will also enable this protocol to advance from one of cryptographic algorithms to an integrated system of cryptographic algorithms and real-time expression and assay of gene expression products.

6 CFR 7.1 - Purpose.

Code of Federal Regulations, 2011 CFR

2011-01-01

... DEPARTMENT OF HOMELAND SECURITY, OFFICE OF THE SECRETARY CLASSIFIED NATIONAL SECURITY INFORMATION § 7.1 Purpose. The purpose of this part is to ensure that information within the Department of Homeland Security... provisions of Executive Order 12958, as amended, and implementing directives from the Information Security...

6 CFR 7.1 - Purpose.

Code of Federal Regulations, 2010 CFR

2010-01-01

... DEPARTMENT OF HOMELAND SECURITY, OFFICE OF THE SECRETARY CLASSIFIED NATIONAL SECURITY INFORMATION § 7.1 Purpose. The purpose of this part is to ensure that information within the Department of Homeland Security... provisions of Executive Order 12958, as amended, and implementing directives from the Information Security...

49 CFR 1.27 - Delegations to the General Counsel.

Code of Federal Regulations, 2012 CFR

2012-10-01

...) (Security and research and development activities), as implemented by 49 CFR part 15 (Protection of Sensitive Security Information), relating to the determination that information is Sensitive Security Information, in consultation and coordination with the Office of Intelligence, Security and Emergency Response...

49 CFR 1.27 - Delegations to the General Counsel.

Code of Federal Regulations, 2013 CFR

2013-10-01

...) (Security and research and development activities), as implemented by 49 CFR part 15 (Protection of Sensitive Security Information), relating to the determination that information is Sensitive Security Information, in consultation and coordination with the Office of Intelligence, Security and Emergency Response...

49 CFR 1.27 - Delegations to the General Counsel.

Code of Federal Regulations, 2014 CFR

2014-10-01

...) (Security and research and development activities), as implemented by 49 CFR part 15 (Protection of Sensitive Security Information), relating to the determination that information is Sensitive Security Information, in consultation and coordination with the Office of Intelligence, Security and Emergency Response...

Dispatching power system for preventive and corrective voltage collapse problem in a deregulated power system

NASA Astrophysics Data System (ADS)

Alemadi, Nasser Ahmed

Deregulation has brought opportunities for increasing efficiency of production and delivery and reduced costs to customers. Deregulation has also bought great challenges to provide the reliability and security customers have come to expect and demand from the electrical delivery system. One of the challenges in the deregulated power system is voltage instability. Voltage instability has become the principal constraint on power system operation for many utilities. Voltage instability is a unique problem because it can produce an uncontrollable, cascading instability that results in blackout for a large region or an entire country. In this work we define a system of advanced analytical methods and tools for secure and efficient operation of the power system in the deregulated environment. The work consists of two modules; (a) contingency selection module and (b) a Security Constrained Optimization module. The contingency selection module to be used for voltage instability is the Voltage Stability Security Assessment and Diagnosis (VSSAD). VSSAD shows that each voltage control area and its reactive reserve basin describe a subsystem or agent that has a unique voltage instability problem. VSSAD identifies each such agent. VS SAD is to assess proximity to voltage instability for each agent and rank voltage instability agents for each contingency simulated. Contingency selection and ranking for each agent is also performed. Diagnosis of where, why, when, and what can be done to cure voltage instability for each equipment outage and transaction change combination that has no load flow solution is also performed. A security constrained optimization module developed solves a minimum control solvability problem. A minimum control solvability problem obtains the reactive reserves through action of voltage control devices that VSSAD determines are needed in each agent to obtain solution of the load flow. VSSAD makes a physically impossible recommendation of adding reactive generation capability to specific generators to allow a load flow solution to be obtained. The minimum control solvability problem can also obtain solution of the load flow without curtailing transactions that shed load and generation as recommended by VSSAD. A minimum control solvability problem will be implemented as a corrective control, that will achieve the above objectives by using minimum control changes. The control includes; (1) voltage setpoint on generator bus voltage terminals; (2) under load tap changer tap positions and switchable shunt capacitors; and (3) active generation at generator buses. The minimum control solvability problem uses the VSSAD recommendation to obtain the feasible stable starting point but completely eliminates the impossible or onerous recommendation made by VSSAD. This thesis reviews the capabilities of Voltage Stability Security Assessment and Diagnosis and how it can be used to implement a contingency selection module for the Open Access System Dispatch (OASYDIS). The OASYDIS will also use the corrective control computed by Security Constrained Dispatch. The corrective control would be computed off line and stored for each contingency that produces voltage instability. The control is triggered and implemented to correct the voltage instability in the agent experiencing voltage instability only after the equipment outage or operating changes predicted to produce voltage instability have occurred. The advantages and the requirements to implement the corrective control are also discussed.

Secret Key Crypto Implementations

NASA Astrophysics Data System (ADS)

Bertoni, Guido Marco; Melzani, Filippo

This chapter presents the algorithm selected in 2001 as the Advanced Encryption Standard. This algorithm is the base for implementing security and privacy based on symmetric key solutions in almost all new applications. Secret key algorithms are used in combination with modes of operation to provide different security properties. The most used modes of operation are presented in this chapter. Finally an overview of the different techniques of software and hardware implementations is given.

Research on mobile electronic commerce security technology based on WPKI

NASA Astrophysics Data System (ADS)

Zhang, Bo

2013-07-01

Through the in-depth study on the existing mobile e-commerce and WAP protocols, this paper presents a security solution of e-commerce system based on WPKI, and describes its implementation process and specific implementation details. This solution uniformly distributes the key used by the various participating entities , to fully ensure the confidentiality, authentication, fairness and integrity of mobile e-commerce payments, therefore has some pract ical value for improving the security of e-commerce system.

Security in the management of information systems.

PubMed

Huston, T L; Huston, J L

1998-06-01

Although security technology exists in abundance in health information management systems, the implementation of that technology is often lacking. This lack of implementation can be heavily affected by the attitudes and perceptions of users and management, the "people part" of systems. Particular operational, organizational, and economic factors must be addressed along with employment of security objectives and accountability. Unique threats, as well as controls, pervade the use of microcomputer-based systems as these systems permeate health care information management.

MDA-based EHR application security services.

PubMed

Blobel, Bernd; Pharow, Peter

2004-01-01

Component-oriented, distributed, virtual EHR systems have to meet enhanced security and privacy requirements. In the context of advanced architectural paradigms such as component-orientation, model-driven, and knowledge-based, standardised security services needed have to be specified and implemented in an integrated way following the same paradigm. This concerns the deployment of formal models, meta-languages, reference models such as the ISO RM-ODP, and development as well as implementation tools. International projects' results presented proceed on that streamline.

45 CFR 164.318 - Compliance dates for the initial implementation of the security standards.

Code of Federal Regulations, 2010 CFR

2010-10-01

... the security standards. 164.318 Section 164.318 Public Welfare DEPARTMENT OF HEALTH AND HUMAN SERVICES ADMINISTRATIVE DATA STANDARDS AND RELATED REQUIREMENTS SECURITY AND PRIVACY Security Standards for the Protection... of the security standards. (a) Health plan. (1) A health plan that is not a small health plan must...

Positioning navigation and timing service applications in cyber physical systems

NASA Astrophysics Data System (ADS)

Qu, Yi; Wu, Xiaojing; Zeng, Lingchuan

2017-10-01

The positioning navigation and timing (PNT) architecture was discussed in detail, whose history, evolvement, current status and future plan were presented, main technologies were listed, advantages and limitations of most technologies were compared, novel approaches were introduced, and future capacities were sketched. The concept of cyber-physical system (CPS) was described and their primary features were interpreted. Then the three-layer architecture of CPS was illustrated. Next CPS requirements on PNT services were analyzed, including requirements on position reference and time reference, requirements on temporal-spatial error monitor, requirements on dynamic services, real-time services, autonomous services, security services and standard services. Finally challenges faced by PNT applications in CPS were concluded. The conclusion was expected to facilitate PNT applications in CPS, and furthermore to provide references to the design and implementation of both architectures.

76 FR 34577 - Wassenaar Arrangement 2010 Plenary Agreements Implementation: Commerce Control List, Definitions...

Federal Register 2010, 2011, 2012, 2013, 2014

2011-06-14

... DEPARTMENT OF COMMERCE Bureau of Industry and Security 15 CFR Parts 740, 743, and 774 [Docket No. 110124056-1301-02] RIN 0694-AF11 Wassenaar Arrangement 2010 Plenary Agreements Implementation: Commerce Control List, Definitions, Reports; Correction AGENCY: Bureau of Industry and Security, Commerce. ACTION...

Designing, Implementing, and Evaluating Secure Web Browsers

ERIC Educational Resources Information Center

Grier, Christopher L.

2009-01-01

Web browsers are plagued with vulnerabilities, providing hackers with easy access to computer systems using browser-based attacks. Efforts that retrofit existing browsers have had limited success since modern browsers are not designed to withstand attack. To enable more secure web browsing, we design and implement new web browsers from the ground…

Martime Security: Ferry Security Measures Have Been Implemented, but Evaluating Existing Studies Could Further Enhance Security

DTIC Science & Technology

2010-12-01

relevant requirements, analyzed 2006 through 2009 security operations data, interviewed federal and industry officials, and made observations at five...warranted, acted on all findings and recommendations resulting from five agency- contracted studies on ferry security completed in 2005 and 2006 ...Figure 5: Security Deficiencies by Vessel Type, 2006 through 2009 27 Figure 6: Security Deficiencies by Facility Type, 2006 through 2009 28

Lessons Learned in Over a Decade of Technical Support for U.S. Nuclear Cyber Security Programmes

DOE Office of Scientific and Technical Information (OSTI.GOV)

Glantz, Clifford S.; Landine, Guy P.; Craig, Philip A.

Pacific Northwest National Laboratory’s (PNNL) nuclear cyber security team has been providing technical support to the U.S. Nuclear Regulatory Commission (NRC) since 2002. This team has provided cyber security technical experties in conducting cyber security inspections, developing of regulatory rules and guidance, reviewing facility cyber security plans, developing inspection guidance, and developing and teaching NRC inspectors how to conduct cyber security assessments. The extensive experience the PNNL team has gathered has allowed them to compile a lenghty list of recommendations on how to improve cyber security programs and conduct assessments. A selected set of recommendations are presented, including the needmore » to: integrate an array of defenisve strategies into a facility’s cyber security program, coordinate physical and cyber security activities, train phycial security forces to resist a cyber-enabled physical attack, improve estimates of the consequences of a cyber attack, properly resource cyber security assessments, appropropriately account for insider threats, routinely monitor security devices for potential attacks, supplement compliance-based requirements with risk-based decision making, and introduce the concept of resilience into cyber security programs.« less

76 FR 78215 - Possession, Use, and Transfer of Select Agents and Toxins; Biennial Review; Proposed Rule

Federal Register 2010, 2011, 2012, 2013, 2014

2011-12-16

... agents and toxins list; whether minimum standards for personnel reliability, physical and cyber security... toxins list; (3) whether minimum standards for personnel reliability, physical and cyber security should...

The design, construction and implementation of a computerised trauma registry in a developing South African metropolitan trauma service.

PubMed

Laing, G L; Bruce, J L; Aldous, C; Clarke, D L

2014-01-01

The Pietermaritzburg Metropolitan Trauma Service formerly lacked a robust computerised trauma registry. This made surgical audit difficult for the purpose of quality of care improvement and development. We aimed to design, construct and implement a computerised trauma registry within our service. Twelve months following its implementation, we sought to examine and report on the quality of the registry. Formal ethical approval to maintain a computerised trauma registry was obtained prior to undertaking any design and development. Appropriate commercial software was sourced to develop this project. The registry was designed as a flat file. A flat file is a plain text or mixed text and binary file which usually contains one record per line or physical record. Thereafter the registry file was launched onto a secure server. This provided the benefits of access security and automated backups. Registry training was provided to clients by the developer. The exercise of data capture was then integrated into the process of service delivery, taking place at the endpoint of patient care (discharge, transfer or death). Twelve months following its implementation, the compliance rates of data entry were measured. The developer of this project managed to design, construct and implement an electronic trauma registry into the service. Twelve months following its implementation the data were extracted and audited to assess the quality. A total of 2640 patient entries were captured onto the registry. Compliance rates were in the order of eighty percent and client satisfaction rates were high. A number of deficits were identified. These included the omission of weekend discharges and underreporting of deaths. The construction and implementation of the computerised trauma registry was the beginning of an endeavour to continue improvements in the quality of care within our service. The registry provided a reliable audit at twelve months post implementation. Deficits and limitations were identified and new strategies have been planned to overcome these problems and integrate the trauma registry into the process of clinical care. Copyright © 2013 Elsevier Ltd. All rights reserved.

78 FR 15722 - Federal Advisory Committee Act; Communications Security, Reliability, and Interoperability Council

Federal Register 2010, 2011, 2012, 2013, 2014

2013-03-12

... Alerting, E9-1-1 Location Accuracy, Network Security Best Practices, DNSSEC Implementation Practices for... FEDERAL COMMUNICATIONS COMMISSION Federal Advisory Committee Act; Communications Security... Security, Reliability, and Interoperability Council (CSRIC) meeting that was scheduled for March 6, 2013 is...

Physical fitness training reference manual for security force personnel at fuel cycle facilities possessing formula quantities of special nuclear materials

DOE Office of Scientific and Technical Information (OSTI.GOV)

Arzino, P.A.; Caplan, C.S.; Goold, R.E.

1991-09-01

The recommendations contained throughout this NUREG are being provided to the Nuclear Regulatory Commission (NRC) as a reference manual which can be used by licensee management as they develop a program plan for the safe participation of guards, Tactical Response Team members (TRTs), and all other armed response personnel in physical fitness training and in physical performance standards testing. The information provided in this NUREG will help licensees to determine if guards, TRTs, and other armed response personnel can effectively perform their normal and emergency duties without undue hazard to themselves, to fellow employees, to the plant site, and tomore » the general public. The recommendations in this NUREG are similar in part to those contained within the Department of Energy (DOE) Medical and Fitness Implementation Guide which was published in March 1991. The guidelines contained in this NUREG are not requirements, and compliance is not required. 25 refs.« less

Maritime security report. November 2000 [Commercial maritime drug smuggling

DOT National Transportation Integrated Search

2000-11-01

Port and security programs being implemented in Colombia's port facilities, maritime jurisdictions, and the marine intermodal shipping cycle are producing successful results against commercial maritime drug smuggling. This security reports examines t...

Secure password-based authenticated key exchange for web services

DOE Office of Scientific and Technical Information (OSTI.GOV)

Liang, Fang; Meder, Samuel; Chevassut, Olivier

This paper discusses an implementation of an authenticated key-exchange method rendered on message primitives defined in the WS-Trust and WS-SecureConversation specifications. This IEEE-specified cryptographic method (AuthA) is proven-secure for password-based authentication and key exchange, while the WS-Trust and WS-Secure Conversation are emerging Web Services Security specifications that extend the WS-Security specification. A prototype of the presented protocol is integrated in the WSRF-compliant Globus Toolkit V4. Further hardening of the implementation is expected to result in a version that will be shipped with future Globus Toolkit releases. This could help to address the current unavailability of decent shared-secret-based authentication options inmore » the Web Services and Grid world. Future work will be to integrate One-Time-Password (OTP) features in the authentication protocol.« less

Information security requirements in patient-centred healthcare support systems.

PubMed

Alsalamah, Shada; Gray, W Alex; Hilton, Jeremy; Alsalamah, Hessah

2013-01-01

Enabling Patient-Centred (PC) care in modern healthcare requires the flow of medical information with the patient between different healthcare providers as they follow the patient's treatment plan. However, PC care threatens the stability of the balance of information security in the support systems since legacy systems fall short of attaining a security balance when sharing their information due to compromises made between its availability, integrity, and confidentiality. Results show that the main reason for this is that information security implementation in discrete legacy systems focused mainly on information confidentiality and integrity leaving availability a challenge in collaboration. Through an empirical study using domain analysis, observations, and interviews, this paper identifies a need for six information security requirements in legacy systems to cope with this situation in order to attain the security balance in systems supporting PC care implementation in modern healthcare.

Game theoretic analysis of physical protection system design

DOE Office of Scientific and Technical Information (OSTI.GOV)

Canion, B.; Schneider, E.; Bickel, E.

The physical protection system (PPS) of a fictional small modular reactor (SMR) facility have been modeled as a platform for a game theoretic approach to security decision analysis. To demonstrate the game theoretic approach, a rational adversary with complete knowledge of the facility has been modeled attempting a sabotage attack. The adversary adjusts his decisions in response to investments made by the defender to enhance the security measures. This can lead to a conservative physical protection system design. Since defender upgrades were limited by a budget, cost benefit analysis may be conducted upon security upgrades. One approach to cost benefitmore » analysis is the efficient frontier, which depicts the reduction in expected consequence per incremental increase in the security budget.« less

Behavioral Analysis of Physical Security Job Analyses. Volume 1.

DTIC Science & Technology

1980-10-01

Job Analyses Personnel Reliability Program Junior Officers Physical Security Morale Motivation 20. ABSTRACT (Continue an reverese ode It neceearly and...internal motivation factors. Assignment of some auxiliary duties to enlisted personnel is possibly conducive to lowered efficiency in physical...subordinates; scheduling pressures; operational alerts and emergencies; relative lack of extrinsic rewards; constant necessity to prove credibility and

Improved Wireless Security through Physical Layer Protocol Manipulation and Radio Frequency Fingerprinting

DTIC Science & Technology

2014-09-18

radios in a cognitive radio network using a radio frequency fingerprinting based method. In IEEE International Conference on Communications (ICC...IMPROVEDWIRELESS SECURITY THROUGH PHYSICAL LAYER PROTOCOL MANIPULATION AND RADIO FREQUENCY FINGERPRINTING DISSERTATION Benjamin W. Ramsey, Captain...PHYSICAL LAYER PROTOCOL MANIPULATION AND RADIO FREQUENCY FINGERPRINTING DISSERTATION Presented to the Faculty Graduate School of Engineering and

Fast and simple high-capacity quantum cryptography with error detection

PubMed Central

Lai, Hong; Luo, Ming-Xing; Pieprzyk, Josef; Zhang, Jun; Pan, Lei; Li, Shudong; Orgun, Mehmet A.

2017-01-01

Quantum cryptography is commonly used to generate fresh secure keys with quantum signal transmission for instant use between two parties. However, research shows that the relatively low key generation rate hinders its practical use where a symmetric cryptography component consumes the shared key. That is, the security of the symmetric cryptography demands frequent rate of key updates, which leads to a higher consumption of the internal one-time-pad communication bandwidth, since it requires the length of the key to be as long as that of the secret. In order to alleviate these issues, we develop a matrix algorithm for fast and simple high-capacity quantum cryptography. Our scheme can achieve secure private communication with fresh keys generated from Fibonacci- and Lucas- valued orbital angular momentum (OAM) states for the seed to construct recursive Fibonacci and Lucas matrices. Moreover, the proposed matrix algorithm for quantum cryptography can ultimately be simplified to matrix multiplication, which is implemented and optimized in modern computers. Most importantly, considerably information capacity can be improved effectively and efficiently by the recursive property of Fibonacci and Lucas matrices, thereby avoiding the restriction of physical conditions, such as the communication bandwidth. PMID:28406240

Fast and simple high-capacity quantum cryptography with error detection.

PubMed

Lai, Hong; Luo, Ming-Xing; Pieprzyk, Josef; Zhang, Jun; Pan, Lei; Li, Shudong; Orgun, Mehmet A

2017-04-13

Quantum cryptography is commonly used to generate fresh secure keys with quantum signal transmission for instant use between two parties. However, research shows that the relatively low key generation rate hinders its practical use where a symmetric cryptography component consumes the shared key. That is, the security of the symmetric cryptography demands frequent rate of key updates, which leads to a higher consumption of the internal one-time-pad communication bandwidth, since it requires the length of the key to be as long as that of the secret. In order to alleviate these issues, we develop a matrix algorithm for fast and simple high-capacity quantum cryptography. Our scheme can achieve secure private communication with fresh keys generated from Fibonacci- and Lucas- valued orbital angular momentum (OAM) states for the seed to construct recursive Fibonacci and Lucas matrices. Moreover, the proposed matrix algorithm for quantum cryptography can ultimately be simplified to matrix multiplication, which is implemented and optimized in modern computers. Most importantly, considerably information capacity can be improved effectively and efficiently by the recursive property of Fibonacci and Lucas matrices, thereby avoiding the restriction of physical conditions, such as the communication bandwidth.

Nevada National Security Site Environmental Report 2011 Attachment A: Site Description

DOE Office of Scientific and Technical Information (OSTI.GOV)

Cathy Wills, ed.

2012-09-12

This attachment expands on the general description of the Nevada National Security Site (NNSS) presented in the Introduction to the Nevada National Security Site Environmental Report 2011. Included are subsections that summarize the site's geological, hydrological, climatological, and ecological setting and the cultural resources of the NNSS. The subsections are meant to aid the reader in understanding the complex physical and biological environment of the NNSS. An adequate knowledge of the site's environment is necessary to assess the environmental impacts of new projects, design and implement environmental monitoring activities for current site operations, and assess the impacts of site operationsmore » on the public residing in the vicinity of the NNSS. The NNSS environment contributes to several key features of the site that afford protection to the inhabitants of adjacent areas from potential exposure to radioactivity or other contaminants resulting from NNSS operations. These key features include the general remote location of the NNSS, restricted access, extended wind transport times, the great depths to slow-moving groundwater, little or no surface water, and low population density. This attachment complements the annual summary of monitoring program activities and dose assessments presented in the main body of this report.« less

Implementation of data security and data privacy provisions will bring sweeping changes to laboratory service providers.

PubMed

Boothe, J F

2000-01-01

The Health Insurance Portability and Accountability Act included substantial changes involving handling of health information by establishing national standards for electronic transactions, data privacy, and data security. The first final rule for electronic transaction standards was published August 17, 2000. The remaining final rules are expected to be published in Winter 2000. Providers, such as clinical laboratories, will have 26 months from the data of publication to comply. The civil monetary fines for noncompliance are substantial. This article will review the key provisions of the data security and data privacy proposed rules. These provisions will touch virtually every aspect of electronic claims submissions, electronic data transactions, and the electronic storage of medical information. The proposed rules will require a coordinated approach by providers to develop the policies and procedures, and the technical and physical infrastructure to protect health information. Moreover, providers will need to identify a privacy officer, to review existing privacy policies to compare the proposed rule with any existing state laws to determine which may be more stringent, and to develop new policies to address the particular requirements of the final rule.

Fast and simple high-capacity quantum cryptography with error detection

NASA Astrophysics Data System (ADS)

Lai, Hong; Luo, Ming-Xing; Pieprzyk, Josef; Zhang, Jun; Pan, Lei; Li, Shudong; Orgun, Mehmet A.

2017-04-01

Quantum cryptography is commonly used to generate fresh secure keys with quantum signal transmission for instant use between two parties. However, research shows that the relatively low key generation rate hinders its practical use where a symmetric cryptography component consumes the shared key. That is, the security of the symmetric cryptography demands frequent rate of key updates, which leads to a higher consumption of the internal one-time-pad communication bandwidth, since it requires the length of the key to be as long as that of the secret. In order to alleviate these issues, we develop a matrix algorithm for fast and simple high-capacity quantum cryptography. Our scheme can achieve secure private communication with fresh keys generated from Fibonacci- and Lucas- valued orbital angular momentum (OAM) states for the seed to construct recursive Fibonacci and Lucas matrices. Moreover, the proposed matrix algorithm for quantum cryptography can ultimately be simplified to matrix multiplication, which is implemented and optimized in modern computers. Most importantly, considerably information capacity can be improved effectively and efficiently by the recursive property of Fibonacci and Lucas matrices, thereby avoiding the restriction of physical conditions, such as the communication bandwidth.

Privacy and Security within Biobanking: The Role of Information Technology.

PubMed

Heatherly, Raymond

2016-03-01

Along with technical issues, biobanking frequently raises important privacy and security issues that must be resolved as biobanks continue to grow in scale and scope. Consent mechanisms currently in use range from fine-grained to very broad, and in some cases participants are offered very few privacy protections. However, developments in information technology are bringing improvements. New programs and systems are being developed to allow researchers to conduct analyses without distributing the data itself offsite, either by allowing the investigator to communicate with a central computer, or by having each site participate in meta-analysis that results in a shared statistic or final significance result. The implementation of security protocols into the research biobanking setting requires three key elements: authentication, authorization, and auditing. Authentication is the process of making sure individuals are who they claim to be, frequently through the use of a password, a key fob, or a physical (i.e., retinal or fingerprint) scan. Authorization involves ensuring that every individual who attempts an action has permission to do that action. Finally, auditing allows for actions to be logged so that inappropriate or unethical actions can later be traced back to their source. © 2016 American Society of Law, Medicine & Ethics.

Minor Corrections to Physics for Optimizing Homeland Security by Our Pal Asija

NASA Astrophysics Data System (ADS)

Asija, Pal

2008-04-01

To optimize Homeland security it must be based on correct physics. There is But ONE Reality of Physics and finding that rugged reality requires identifying and expunging erroneous knowledge. Six examples are included. *Lighter Bodies Travel Faster. (Aristotle got it backwards) *Faster Objects Become Lighter. (Einstein got it backwards) *Two Minor Corrections to Newton's First Law of Motion. *Three D or No D (Any theory based on other than 3 D is fantastic) *Gravity is A Local and Physical Contact Force *Light is never Waves and Photons at the Same Instant. These corrections are then further delineated by several examples for leading and driving innovations in homeland security.

A Method for Evaluating Information Security Governance (ISG) Components in Banking Environment

NASA Astrophysics Data System (ADS)

Ula, M.; Ula, M.; Fuadi, W.

2017-02-01

As modern banking increasingly relies on the internet and computer technologies to operate their businesses and market interactions, the threats and security breaches have highly increased in recent years. Insider and outsider attacks have caused global businesses lost trillions of Dollars a year. Therefore, that is a need for a proper framework to govern the information security in the banking system. The aim of this research is to propose and design an enhanced method to evaluate information security governance (ISG) implementation in banking environment. This research examines and compares the elements from the commonly used information security governance frameworks, standards and best practices. Their strength and weakness are considered in its approaches. The initial framework for governing the information security in banking system was constructed from document review. The framework was categorized into three levels which are Governance level, Managerial level, and technical level. The study further conducts an online survey for banking security professionals to get their professional judgment about the ISG most critical components and the importance for each ISG component that should be implemented in banking environment. Data from the survey was used to construct a mathematical model for ISG evaluation, component importance data used as weighting coefficient for the related component in the mathematical model. The research further develops a method for evaluating ISG implementation in banking based on the mathematical model. The proposed method was tested through real bank case study in an Indonesian local bank. The study evidently proves that the proposed method has sufficient coverage of ISG in banking environment and effectively evaluates the ISG implementation in banking environment.

National Computer Security Conference Proceedings (12th): Information Systems Security: Solutions for Today - Concepts for Tomorrow Held in Baltimore, Maryland on 10-13 October 1989

DTIC Science & Technology

1989-10-13

and other non -technical aspects of the system). System-wide Perspective. The systerm that is being designed and engineered must include not just the...specifications and is regarded as the lowest-level (implementation) of detail.-’ Ihis decomposition follows the typical "top down" design methodology ...formal verification process has contributed to the security and correctness of the TCB design and implementation. FORMUL METHODOLOGY DESCRIPTION The

Design, Development, and Automated Verification of an Integrity-Protected Hypervisor

DTIC Science & Technology

2012-07-16

mechanism for implementing software virtualization. Since hypervisors execute at a very high privilege level, they must be secure. A fundamental security...using the CBMC model checker. CBMC verified XMHF?s implementation ? about 4700 lines of C code ? in about 80 seconds using less than 2GB of RAM. 15...Hypervisors are a popular mechanism for implementing software virtualization. Since hypervisors execute at a very high privilege level, they must be

49 CFR 1549.103 - Qualifications and training of individuals with security-related duties.

Code of Federal Regulations, 2010 CFR

2010-10-01

... with security-related duties. (a) Security threat assessments. Each certified cargo screening facility... certified cargo screening facility complete a security threat assessment or comparable security threat... acuity, physical coordination, and motor skills to the extent required to effectively operate cargo...

6 CFR 7.3 - Definitions.

Code of Federal Regulations, 2011 CFR

2011-01-01

... 6 Domestic Security 1 2011-01-01 2011-01-01 false Definitions. 7.3 Section 7.3 Domestic Security DEPARTMENT OF HOMELAND SECURITY, OFFICE OF THE SECRETARY CLASSIFIED NATIONAL SECURITY INFORMATION § 7.3 Definitions. The terms defined or used in Executive Order 12958, as amended, and the implementing directives...

12 CFR Appendix B to Part 364 - Interagency Guidelines Establishing Information Security Standards

Code of Federal Regulations, 2011 CFR

2011-01-01

... Part 364—Interagency Guidelines Establishing Information Security Standards Table of Contents I... Customer Information A. Information Security Program B. Objectives III. Development and Implementation of Customer Information Security Program A. Involve the Board of Directors B. Assess Risk C. Manage and...

6 CFR 7.3 - Definitions.

Code of Federal Regulations, 2010 CFR

2010-01-01

... 6 Domestic Security 1 2010-01-01 2010-01-01 false Definitions. 7.3 Section 7.3 Domestic Security DEPARTMENT OF HOMELAND SECURITY, OFFICE OF THE SECRETARY CLASSIFIED NATIONAL SECURITY INFORMATION § 7.3 Definitions. The terms defined or used in Executive Order 12958, as amended, and the implementing directives...

5 CFR 9701.401 - Purpose.

Code of Federal Regulations, 2010 CFR

2010-01-01

... Administrative Personnel DEPARTMENT OF HOMELAND SECURITY HUMAN RESOURCES MANAGEMENT SYSTEM (DEPARTMENT OF HOMELAND SECURITY-OFFICE OF PERSONNEL MANAGEMENT) DEPARTMENT OF HOMELAND SECURITY HUMAN RESOURCES... adequate resources are allocated for the design, implementation, and administration of the performance...

5 CFR 9701.301 - Purpose.

Code of Federal Regulations, 2010 CFR

2010-01-01

... Administrative Personnel DEPARTMENT OF HOMELAND SECURITY HUMAN RESOURCES MANAGEMENT SYSTEM (DEPARTMENT OF HOMELAND SECURITY-OFFICE OF PERSONNEL MANAGEMENT) DEPARTMENT OF HOMELAND SECURITY HUMAN RESOURCES... resources are allocated for the design, implementation, and administration of the performance management...

Addressing cargo security with strategies involving private sector.

DOT National Transportation Integrated Search

2008-12-01

The public and private sectors contributing to goods movement agree that cargo security has : not been addressed nearly as much as physical and vessel security. Addressing cargo security : will require additional operational data that is not currentl...

77 FR 21120 - Self-Regulatory Organizations; NYSE Arca, Inc.; Notice of Filing of Proposed Rule Change to List...

Federal Register 2010, 2011, 2012, 2013, 2014

2012-04-09

... Contracts Overlying 10 Shares of a Security (``Mini-Options Contracts'') and Implementing Rule Text... contracts'') and implement rule text necessary to distinguish mini-options contracts from option contracts overlying 100 shares of a security (``standard contracts''). The text of the proposed rule change is...

75 FR 31273 - Social Security Administration Implementation of OMB Guidance for Drug-Free Workplace Requirements

Federal Register 2010, 2011, 2012, 2013, 2014

2010-06-03

...;Prices of new books are listed in the first FEDERAL REGISTER issue of each #0;week. #0; #0; #0; #0;#0...-AH14 Social Security Administration Implementation of OMB Guidance for Drug-Free Workplace Requirements... workplace requirements for recipients of financial assistance. Accordingly, we are removing our regulation...

12 CFR Appendix A to Part 748 - Guidelines for Safeguarding Member Information

Code of Federal Regulations, 2014 CFR

2014-01-01

... Implementation of Member Information Security Program A. Involve the Board of Directors B. Assess Risk C. Manage and Control Risk D. Oversee Service Provider Arrangements E. Adjust the Program F. Report to the Board.... Development and Implementation of Member Information Security Program A. Involve the Board of Directors. The...

12 CFR Appendix A to Part 748 - Guidelines for Safeguarding Member Information

Code of Federal Regulations, 2013 CFR

2013-01-01

... Implementation of Member Information Security Program A. Involve the Board of Directors B. Assess Risk C. Manage and Control Risk D. Oversee Service Provider Arrangements E. Adjust the Program F. Report to the Board.... Development and Implementation of Member Information Security Program A. Involve the Board of Directors. The...

12 CFR Appendix A to Part 748 - Guidelines for Safeguarding Member Information

Code of Federal Regulations, 2011 CFR

2011-01-01

... Implementation of Member Information Security Program A. Involve the Board of Directors B. Assess Risk C. Manage and Control Risk D. Oversee Service Provider Arrangements E. Adjust the Program F. Report to the Board.... Development and Implementation of Member Information Security Program A. Involve the Board of Directors. The...

12 CFR Appendix A to Part 748 - Guidelines for Safeguarding Member Information

Code of Federal Regulations, 2012 CFR

2012-01-01

... Implementation of Member Information Security Program A. Involve the Board of Directors B. Assess Risk C. Manage and Control Risk D. Oversee Service Provider Arrangements E. Adjust the Program F. Report to the Board.... Development and Implementation of Member Information Security Program A. Involve the Board of Directors. The...

75 FR 50846 - Privacy Act of 1974: Implementation of Exemptions; Department of Homeland Security/ALL-001...

Federal Register 2010, 2011, 2012, 2013, 2014

2010-08-18

... INFORMATION CONTACT: For general questions and privacy issues please contact: Mary Ellen Callahan (703-235...] Privacy Act of 1974: Implementation of Exemptions; Department of Homeland Security/ALL--001 Freedom of Information Act and Privacy Act Records System of Records AGENCY: Privacy Office, DHS. ACTION: Final rule...

17 CFR 39.4 - Procedures for implementing derivatives clearing organization rules and clearing new products.

Code of Federal Regulations, 2010 CFR

2010-04-01

... 17 Commodity and Securities Exchanges 1 2010-04-01 2010-04-01 false Procedures for implementing derivatives clearing organization rules and clearing new products. 39.4 Section 39.4 Commodity and Securities Exchanges COMMODITY FUTURES TRADING COMMISSION DERIVATIVES CLEARING ORGANIZATIONS § 39.4 Procedures for...

Implementing HIPAA security in a membership organization.

PubMed

Hillabrant, L P; Gaignard, K E

2000-01-01

The upcoming HIPAA security regulations are forcing a change in business and operating procedures that many, if not most, healthcare organizations are ill-prepared to tackle. Of all healthcare organizational structures, membership organizations will most likely face the greatest number of obstacles in preparing for and implementing the HIPAA security regulations. This is because the membership organization as a whole must find a way to accommodate the disparate technologies, business and operating methodologies and processes, and available, limited resources of its individual member organizations, and integrate these into a uniform implementation plan. Compounding these obvious difficulties is the unique challenge of enforcement authority. The individual member organizations are autonomous business entities, whereas the membership organization as a whole merely acts as an advisor or consultant, and has only limited enforcement authority over any individual member organization. This article explores this unique situation in depth. We focus on PROMINA Health System, a nonprofit healthcare membership organization that consists of five disparate member healthcare organizations. We examine the challenges PROMINA has encountered in its quest to institute an organization-wide HIPAA security program and its methodology for accomplishing program implementation.

A Systems Engineering Framework for Implementing a Security and Critical Patch Management Process in Diverse Environments (Academic Departments' Workstations)

NASA Astrophysics Data System (ADS)

Mohammadi, Hadi

Use of the Patch Vulnerability Management (PVM) process should be seriously considered for any networked computing system. The PVM process prevents the operating system (OS) and software applications from being attacked due to security vulnerabilities, which lead to system failures and critical data leakage. The purpose of this research is to create and design a Security and Critical Patch Management Process (SCPMP) framework based on Systems Engineering (SE) principles. This framework will assist Information Technology Department Staff (ITDS) to reduce IT operating time and costs and mitigate the risk of security and vulnerability attacks. Further, this study evaluates implementation of the SCPMP in the networked computing systems of an academic environment in order to: 1. Meet patch management requirements by applying SE principles. 2. Reduce the cost of IT operations and PVM cycles. 3. Improve the current PVM methodologies to prevent networked computing systems from becoming the targets of security vulnerability attacks. 4. Embed a Maintenance Optimization Tool (MOT) in the proposed framework. The MOT allows IT managers to make the most practicable choice of methods for deploying and installing released patches and vulnerability remediation. In recent years, there has been a variety of frameworks for security practices in every networked computing system to protect computer workstations from becoming compromised or vulnerable to security attacks, which can expose important information and critical data. I have developed a new mechanism for implementing PVM for maximizing security-vulnerability maintenance, protecting OS and software packages, and minimizing SCPMP cost. To increase computing system security in any diverse environment, particularly in academia, one must apply SCPMP. I propose an optimal maintenance policy that will allow ITDS to measure and estimate the variation of PVM cycles based on their department's requirements. My results demonstrate that MOT optimizes the process of implementing SCPMP in academic workstations.

10 CFR 95.33 - Security education.

Code of Federal Regulations, 2011 CFR

2011-01-01

... 10 Energy 2 2011-01-01 2011-01-01 false Security education. 95.33 Section 95.33 Energy NUCLEAR... INFORMATION AND RESTRICTED DATA Physical Security § 95.33 Security education. All cleared employees must be... information. The facility may obtain defensive security, threat awareness, and other education and training...

10 CFR 95.33 - Security education.

Code of Federal Regulations, 2013 CFR

2013-01-01

... 10 Energy 2 2013-01-01 2013-01-01 false Security education. 95.33 Section 95.33 Energy NUCLEAR... INFORMATION AND RESTRICTED DATA Physical Security § 95.33 Security education. All cleared employees must be... information. The facility may obtain defensive security, threat awareness, and other education and training...

10 CFR 95.33 - Security education.

Code of Federal Regulations, 2012 CFR

2012-01-01

... 10 Energy 2 2012-01-01 2012-01-01 false Security education. 95.33 Section 95.33 Energy NUCLEAR... INFORMATION AND RESTRICTED DATA Physical Security § 95.33 Security education. All cleared employees must be... information. The facility may obtain defensive security, threat awareness, and other education and training...

10 CFR 95.33 - Security education.

Code of Federal Regulations, 2010 CFR

2010-01-01

... 10 Energy 2 2010-01-01 2010-01-01 false Security education. 95.33 Section 95.33 Energy NUCLEAR... INFORMATION AND RESTRICTED DATA Physical Security § 95.33 Security education. All cleared employees must be... information. The facility may obtain defensive security, threat awareness, and other education and training...

10 CFR 1016.12 - Termination of security facility approval.

Code of Federal Regulations, 2011 CFR

2011-01-01

... 10 Energy 4 2011-01-01 2011-01-01 false Termination of security facility approval. 1016.12 Section 1016.12 Energy DEPARTMENT OF ENERGY (GENERAL PROVISIONS) SAFEGUARDING OF RESTRICTED DATA Physical Security § 1016.12 Termination of security facility approval. Security facility approval will be terminated...

10 CFR 1016.12 - Termination of security facility approval.

Code of Federal Regulations, 2010 CFR

2010-01-01

... 10 Energy 4 2010-01-01 2010-01-01 false Termination of security facility approval. 1016.12 Section 1016.12 Energy DEPARTMENT OF ENERGY (GENERAL PROVISIONS) SAFEGUARDING OF RESTRICTED DATA Physical Security § 1016.12 Termination of security facility approval. Security facility approval will be terminated...

78 FR 34264 - Technical Corrections to the HIPAA Privacy, Security, and Enforcement Rules

Federal Register 2010, 2011, 2012, 2013, 2014

2013-06-07

...-AA03 Technical Corrections to the HIPAA Privacy, Security, and Enforcement Rules AGENCY: Office for... corrections address certain inadvertent errors and omissions in the HIPAA Privacy, Security, and Enforcement... (HHS or ``the Department'') published a final rule to implement changes to the HIPAA Privacy, Security...

48 CFR 225.872-7 - Industrial security for qualifying countries.

Code of Federal Regulations, 2010 CFR

2010-10-01

... 48 Federal Acquisition Regulations System 3 2010-10-01 2010-10-01 false Industrial security for... Agreements and Coordination 225.872-7 Industrial security for qualifying countries. The required procedures... qualifying country sources are in the DoD Industrial Security Regulation DoD 5220.22-R (implemented for the...

15 CFR 2008.16 - Security education program.

Code of Federal Regulations, 2010 CFR

2010-01-01

... 15 Commerce and Foreign Trade 3 2010-01-01 2010-01-01 false Security education program. 2008.16... REPRESENTATIVE Safeguards § 2008.16 Security education program. (a) The Office of the Special Representative for... charged with the implementation of this security education program and shall issue detailed procedures for...

7 CFR 331.11 - Security.

Code of Federal Regulations, 2012 CFR

2012-01-01

... 7 Agriculture 5 2012-01-01 2012-01-01 false Security. 331.11 Section 331.11 Agriculture..., DEPARTMENT OF AGRICULTURE POSSESSION, USE, AND TRANSFER OF SELECT AGENTS AND TOXINS § 331.11 Security. (a) An individual or entity required to register under this part must develop and implement a written security plan...

7 CFR 331.11 - Security.

Code of Federal Regulations, 2011 CFR

2011-01-01

... 7 Agriculture 5 2011-01-01 2011-01-01 false Security. 331.11 Section 331.11 Agriculture..., DEPARTMENT OF AGRICULTURE POSSESSION, USE, AND TRANSFER OF SELECT AGENTS AND TOXINS § 331.11 Security. (a) An individual or entity required to register under this part must develop and implement a written security plan...

7 CFR 331.11 - Security.

Code of Federal Regulations, 2010 CFR

2010-01-01

... 7 Agriculture 5 2010-01-01 2010-01-01 false Security. 331.11 Section 331.11 Agriculture..., DEPARTMENT OF AGRICULTURE POSSESSION, USE, AND TRANSFER OF SELECT AGENTS AND TOXINS § 331.11 Security. (a) An individual or entity required to register under this part must develop and implement a written security plan...

49 CFR 659.21 - System security plan: general requirements.

Code of Federal Regulations, 2010 CFR

2010-10-01

... 49 Transportation 7 2010-10-01 2010-10-01 false System security plan: general requirements. 659.21... State Oversight Agency § 659.21 System security plan: general requirements. (a) The oversight agency shall require the rail transit agency to implement a system security plan that, at a minimum, complies...

45 CFR 155.260 - Privacy and security of personally identifiable information.

Code of Federal Regulations, 2013 CFR

2013-10-01

... 45 Public Welfare 1 2013-10-01 2013-10-01 false Privacy and security of personally identifiable... AFFORDABLE CARE ACT General Functions of an Exchange § 155.260 Privacy and security of personally... must establish and implement privacy and security standards that are consistent with the following...

32 CFR Appendix J to Part 154 - ADP Position Categories and Criteria for Designating Positions

Code of Federal Regulations, 2010 CFR

2010-07-01

..., and implementation of a computer security program; major responsibility for the direction, planning... agency computer security programs, and also including direction and control of risk analysis and/or... OF DEFENSE SECURITY DEPARTMENT OF DEFENSE PERSONNEL SECURITY PROGRAM REGULATION Pt. 154, App. J...

22 CFR 1101.5 - Security, confidentiality and protection of records.

Code of Federal Regulations, 2011 CFR

2011-04-01

... Bureau of Standard's booklet “Computer Security Guidelines for Implementing the Privacy Act of 1974” (May... 22 Foreign Relations 2 2011-04-01 2009-04-01 true Security, confidentiality and protection of... STATES AND MEXICO, UNITED STATES SECTION PRIVACY ACT OF 1974 § 1101.5 Security, confidentiality and...

32 CFR Appendix J to Part 154 - ADP Position Categories and Criteria for Designating Positions

Code of Federal Regulations, 2014 CFR

2014-07-01

..., and implementation of a computer security program; major responsibility for the direction, planning... agency computer security programs, and also including direction and control of risk analysis and/or... OF DEFENSE SECURITY DEPARTMENT OF DEFENSE PERSONNEL SECURITY PROGRAM REGULATION Pt. 154, App. J...

22 CFR 1101.5 - Security, confidentiality and protection of records.

Code of Federal Regulations, 2014 CFR

2014-04-01

... Bureau of Standard's booklet “Computer Security Guidelines for Implementing the Privacy Act of 1974” (May... 22 Foreign Relations 2 2014-04-01 2014-04-01 false Security, confidentiality and protection of... STATES AND MEXICO, UNITED STATES SECTION PRIVACY ACT OF 1974 § 1101.5 Security, confidentiality and...

22 CFR 1101.5 - Security, confidentiality and protection of records.

Code of Federal Regulations, 2013 CFR

2013-04-01

... Bureau of Standard's booklet “Computer Security Guidelines for Implementing the Privacy Act of 1974” (May... 22 Foreign Relations 2 2013-04-01 2009-04-01 true Security, confidentiality and protection of... STATES AND MEXICO, UNITED STATES SECTION PRIVACY ACT OF 1974 § 1101.5 Security, confidentiality and...

32 CFR Appendix J to Part 154 - ADP Position Categories and Criteria for Designating Positions

Code of Federal Regulations, 2012 CFR

2012-07-01

..., and implementation of a computer security program; major responsibility for the direction, planning... agency computer security programs, and also including direction and control of risk analysis and/or... OF DEFENSE SECURITY DEPARTMENT OF DEFENSE PERSONNEL SECURITY PROGRAM REGULATION Pt. 154, App. J...

22 CFR 1101.5 - Security, confidentiality and protection of records.

Code of Federal Regulations, 2012 CFR

2012-04-01

... Bureau of Standard's booklet “Computer Security Guidelines for Implementing the Privacy Act of 1974” (May... 22 Foreign Relations 2 2012-04-01 2009-04-01 true Security, confidentiality and protection of... STATES AND MEXICO, UNITED STATES SECTION PRIVACY ACT OF 1974 § 1101.5 Security, confidentiality and...

32 CFR Appendix J to Part 154 - ADP Position Categories and Criteria for Designating Positions

Code of Federal Regulations, 2013 CFR

2013-07-01

..., and implementation of a computer security program; major responsibility for the direction, planning... agency computer security programs, and also including direction and control of risk analysis and/or... OF DEFENSE SECURITY DEPARTMENT OF DEFENSE PERSONNEL SECURITY PROGRAM REGULATION Pt. 154, App. J...

32 CFR Appendix J to Part 154 - ADP Position Categories and Criteria for Designating Positions

Code of Federal Regulations, 2011 CFR

2011-07-01

..., and implementation of a computer security program; major responsibility for the direction, planning... agency computer security programs, and also including direction and control of risk analysis and/or... OF DEFENSE SECURITY DEPARTMENT OF DEFENSE PERSONNEL SECURITY PROGRAM REGULATION Pt. 154, App. J...

22 CFR 1101.5 - Security, confidentiality and protection of records.

Code of Federal Regulations, 2010 CFR

2010-04-01

... Bureau of Standard's booklet “Computer Security Guidelines for Implementing the Privacy Act of 1974” (May... 22 Foreign Relations 2 2010-04-01 2010-04-01 true Security, confidentiality and protection of... STATES AND MEXICO, UNITED STATES SECTION PRIVACY ACT OF 1974 § 1101.5 Security, confidentiality and...

12 CFR Appendix B to Part 170 - Interagency Guidelines Establishing Information Security Standards

Code of Federal Regulations, 2014 CFR

2014-01-01

... Security Standards B Appendix B to Part 170 Banks and Banking COMPTROLLER OF THE CURRENCY, DEPARTMENT OF... Part 170—Interagency Guidelines Establishing Information Security Standards Table of Contents I... Customer Information A. Information Security Program B. Objectives III. Development and Implementation of...

12 CFR Appendix B to Part 170 - Interagency Guidelines Establishing Information Security Standards

Code of Federal Regulations, 2013 CFR

2013-01-01

... Security Standards B Appendix B to Part 170 Banks and Banking COMPTROLLER OF THE CURRENCY, DEPARTMENT OF... Part 170—Interagency Guidelines Establishing Information Security Standards Table of Contents I... Customer Information A. Information Security Program B. Objectives III. Development and Implementation of...

7 CFR 331.11 - Security.

Code of Federal Regulations, 2014 CFR

2014-01-01

... 7 Agriculture 5 2014-01-01 2014-01-01 false Security. 331.11 Section 331.11 Agriculture..., DEPARTMENT OF AGRICULTURE POSSESSION, USE, AND TRANSFER OF SELECT AGENTS AND TOXINS § 331.11 Security. (a) An individual or entity required to register under this part must develop and implement a written security plan...

Physical security, HIPPA, and the HHS wall of shame.

PubMed

Sage, April

2014-01-01

In this article, the author a healthcare IT expert, reveals what experts have discovered in analyzing HIPPA data breaches. Most are the result of theft or loss. She explains why this is so, and offers a solution--improved physical security.

Unconditionally Secure Credit/Debit Card Chip Scheme and Physical Unclonable Function

NASA Astrophysics Data System (ADS)

Kish, Laszlo B.; Entesari, Kamran; Granqvist, Claes-Göran; Kwan, Chiman

The statistical-physics-based Kirchhoff-law-Johnson-noise (KLJN) key exchange offers a new and simple unclonable system for credit/debit card chip authentication and payment. The key exchange, the authentication and the communication are unconditionally secure so that neither mathematics- nor statistics-based attacks are able to crack the scheme. The ohmic connection and the short wiring lengths between the chips in the card and the terminal constitute an ideal setting for the KLJN protocol, and even its simplest versions offer unprecedented security and privacy for credit/debit card chips and applications of physical unclonable functions (PUFs).

Security giving in surrogacy motherhood process as a caring model for commissioning mothers: A theory synthesis.

PubMed

Zandi, Mitra; Vanaki, Zohreh; Shiva, Marziyeh; Mohammadi, Eesa; Bagheri-Lankarani, Narges

2016-07-01

Despite the increasing use of surrogacy, there are no caring theories/models that serve as the basis for nursing care to surrogacy commissioning mothers. This study has designed a model for caring of surrogacy commissioning mothers in 2013. The theory synthesis of Walker and Avant's strategies of theory construction (2011) was used to design a caring model/theory. The theory synthesis includes three stages: (i) selection of focal concept (the concept of "security giving in motherhood" was selected); (ii) review of studies in order to identify factors related to focal concept relevant studies (42 articles and 13 books) were reviewed, statements and concepts related to focal concept were then extracted and classified, and their relations were specified; and (iii) organization of concepts and statements within a relevant general and effective manifestation of the phenomenon under study which led to developing of a model. In this caring model/theory, entitled "security giving in surrogacy motherhood", nurses roles were conceptualized within the conceptual framework that includes three main roles: (i) coordination; (ii) participation; and (iii) security giving (physical, emotional, and legal support; empowerment; presence; relationship management between both parties and advocacy). Training surrogacy specialist nurses and establishment of surrogacy care centers are important factors for implementation of the model. This model could help to provided better caring for surrogacy clients, especially for commissioning mothers. © 2016 Japan Academy of Nursing Science.

Effect of innovative building design on physical activity.

PubMed

Nicoll, Gayle; Zimring, Craig

2009-01-01

Stair climbing can be a low-cost and relatively accessible way to add everyday physical activity, but many building stairwells are inaccessible or unpleasant and elevators are far more convenient. This study explores the use of and attitude toward stairs in an innovative office building where the main elevators for able-bodied users stop only at every third floor ("skip-stop" elevators). These users are expected to walk up or down nearby stairs that have been made open and appealing ("skip-stop" stairs). The study takes advantage of a natural experiment. Some workers' offices were clustered around the skip-stop elevator and the stairs, whereas others had access to a traditional elevator core, that is, an elevator that stopped at each floor with nearby fire exit stairs. Stair use on the open skip-stop stairs and enclosed fire stairs was measured using infrared monitors and card-reader activity logs. An online survey of employees (N=299, a 17.4% response rate) gathered information on stair use and attitudes and behaviors toward physical activity; interviews with key personnel identified major implementation issues. The skip-stop stair was used 33 times more than the enclosed stair of the traditional elevator core, with 72% of survey participants reporting daily stair use. Although implementation issues related to organizational objectives, costs, security, barrier-free accessibility, and building codes exist, the skip-stop feature offers a successful strategy for increasing stair use in workplaces.

Aviation security : vulnerabilities still exist in the aviation security system

DOT National Transportation Integrated Search

2000-04-06

The testimony today discusses the Federal Aviation Administration's (FAA) efforts to implement and improve security in two key areas: air traffic control computer systems and airport passenger screening checkpoints. Computer systems-and the informati...

15 CFR 701.1 - Purpose.

Code of Federal Regulations, 2010 CFR

2010-01-01

... AND SECURITY, DEPARTMENT OF COMMERCE NATIONAL SECURITY INDUSTRIAL BASE REGULATIONS REPORTING OF... designated the Bureau of Industry and Security as the organization responsible for implementing this... offset transactions on the defense preparedness, industrial competitiveness, employment, and trade of the...

A Simple Snap Oscillator with Coexisting Attractors, Its Time-Delayed Form, Physical Realization, and Communication Designs

NASA Astrophysics Data System (ADS)

Rajagopal, Karthikeyan; Jafari, Sajad; Akgul, Akif; Karthikeyan, Anitha; Çiçek, Serdar; Shekofteh, Yasser

2018-05-01

In this paper, we report a novel chaotic snap oscillator with one nonlinear function. Dynamic analysis of the system shows the existence of bistability. To study the time delay effects on the proposed snap oscillator, we introduce multiple time delay in the fourth state equation. Investigation of dynamical properties of the time-delayed system shows that the snap oscillator exhibits the same multistable properties as the nondelayed system. The new multistable hyperjerk chaotic system has been tested in chaos shift keying and symmetric choc shift keying modulated communication designs for engineering applications. It has been determined that the symmetric chaos shift keying modulated communication system implemented with the new chaotic system is more successful than the chaos shift keying modulation for secure communication. Also, circuit implementation of the chaotic snap oscillator with tangent function is carried out showing its feasibility.

DRMS (Defense Reutilization and Marketing Service) Total Quality Management (TQM) Implementation Plan

DTIC Science & Technology

1989-07-01

FUNDING NUMBERS DRMS Total Quality Management (TQM) Implementation Plan 6. AUTHOR(S) 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING...OF PAGES TOM (Total Quality Management ), Continuous Process Improvement. ’f’ - Management 16. PRICE CODE 17. SECURITY CLASSIFICATION 18. SECURITY...7540-01-280-5500 Standard Form 298 (Rev. 2-89) Pr"cried by ANi SWt 139-i 296-101 DRMS TOTAL QUALITY MANAGEMENT (TQM) IMPLEMENTATION PLAN PURPOSE The

R2U2: Monitoring and Diagnosis of Security Threats for Unmanned Aerial Systems

NASA Technical Reports Server (NTRS)

Schumann, Johann; Moosbruger, Patrick; Rozier, Kristin Y.

2015-01-01

We present R2U2, a novel framework for runtime monitoring of security properties and diagnosing of security threats on-board Unmanned Aerial Systems (UAS). R2U2, implemented in FPGA hardware, is a real-time, REALIZABLE, RESPONSIVE, UNOBTRUSIVE Unit for security threat detection. R2U2 is designed to continuously monitor inputs from the GPS and the ground control station, sensor readings, actuator outputs, and flight software status. By simultaneously monitoring and performing statistical reasoning, attack patterns and post-attack discrepancies in the UAS behavior can be detected. R2U2 uses runtime observer pairs for linear and metric temporal logics for property monitoring and Bayesian networks for diagnosis of security threats. We discuss the design and implementation that now enables R2U2 to handle security threats and present simulation results of several attack scenarios on the NASA DragonEye UAS.

Safe teleradiology: information assurance as project planning methodology.

PubMed

Collmann, Jeff; Alaoui, Adil; Nguyen, Dan; Lindisch, David

2005-01-01

The Georgetown University Medical Center Department of Radiology used a tailored version of OCTAVE, a self-directed information security risk assessment method, to design a teleradiology system that complied with the regulation implementing the security provisions of the Health Insurance Portability and Accountability Act (HIPAA) of 1996. The system addressed threats to and vulnerabilities in the privacy and security of protected health information. By using OCTAVE, Georgetown identified the teleradiology program's critical assets, described threats to the assurance of those assets, developed and ran vulnerability scans of a system pilot, evaluated the consequences of security breaches, and developed a risk management plan to mitigate threats to program assets, thereby implementing good information assurance practices. This case study illustrates the basic point that prospective, comprehensive planning to protect the privacy and security of an information system strategically benefits program management as well as system security.

How to implement security controls for an information security program at CBRN facilities

DOE Office of Scientific and Technical Information (OSTI.GOV)

Lenaeus, Joseph D.; O'Neil, Lori Ross; Leitch, Rosalyn M.

This document was prepared by PNNL within the framework of Project 19 of the European Union Chemical Biological Radiological and Nuclear Risk Mitigation Centres of Excellence Initiative entitled, ''Development of procedures and guidelines to create and improve secure information management systems and data exchange mechanisms for CBRN materials under regulatory control.'' It provides management and workers at CBRN facilities, parent organization managers responsible for those facilities, and regulatory agencies (governmental and nongovernmental) with guidance on the best practices for protecting information security. The security mitigation approaches presented in this document were chosen because they present generally accepted guidance in anmore » easy-to-understand manner, making it easier for facility personnel to grasp key concepts and envision how security controls could be implemented by the facility. This guidance is presented from a risk management perspective.« less

Development of quantitative security optimization approach for the picture archives and carrying system between a clinic and a rehabilitation center

NASA Astrophysics Data System (ADS)

Haneda, Kiyofumi; Kajima, Toshio; Koyama, Tadashi; Muranaka, Hiroyuki; Dojo, Hirofumi; Aratani, Yasuhiko

2002-05-01

The target of our study is to analyze the level of necessary security requirements, to search for suitable security measures and to optimize security distribution to every portion of the medical practice. Quantitative expression must be introduced to our study, if possible, to enable simplified follow-up security procedures and easy evaluation of security outcomes or results. Using fault tree analysis (FTA), system analysis showed that system elements subdivided into groups by details result in a much more accurate analysis. Such subdivided composition factors greatly depend on behavior of staff, interactive terminal devices, kinds of services provided, and network routes. Security measures were then implemented based on the analysis results. In conclusion, we identified the methods needed to determine the required level of security and proposed security measures for each medical information system, and the basic events and combinations of events that comprise the threat composition factors. Methods for identifying suitable security measures were found and implemented. Risk factors for each basic event, a number of elements for each composition factor, and potential security measures were found. Methods to optimize the security measures for each medical information system were proposed, developing the most efficient distribution of risk factors for basic events.

From mobile mental health to mobile wellbeing: opportunities and challenges.

PubMed

Gaggioli, Andrea; Riva, Giuseppe

2013-01-01

The combination of smart phones, wearable sensor devices and social media offer new ways of monitoring and promoting mental and physical wellbeing. In this contribution, we describe recent developments in the field of mobile healthcare (or mHealth), by focusing in particular on mobile mental health applications. First, we examine the potential benefits associated with this approach, providing examples from existing projects. Next, we identify and explain possible differences in focus between mobile mental health and mobile wellbeing applications. Finally, we discuss some open challenges associated with the implementation of this vision, ranging from the lack of evidence-based validation to privacy, security and ethical concerns.

Facilitating and securing offline e-medicine service through image steganography

PubMed Central

Islam, M. Mahfuzul

2014-01-01

E-medicine is a process to provide health care services to people using the Internet or any networking technology. In this Letter, a new idea is proposed to model the physical structure of the e-medicine system to better provide offline health care services. Smart cards are used to authenticate the user singly. A very unique technique is also suggested to verify the card owner's identity and to embed secret data to the card while providing patients' reports either at booths or at the e-medicine server system. The simulation results of card authentication and embedding procedure justify the proposed implementation. PMID:26609382

10 CFR 95.33 - Security education.

Code of Federal Regulations, 2014 CFR

2014-01-01

... 10 Energy 2 2014-01-01 2014-01-01 false Security education. 95.33 Section 95.33 Energy NUCLEAR... INFORMATION AND RESTRICTED DATA Physical Security § 95.33 Security education. All cleared employees must be... providing security education and training. A licensee or other entity subject to part 95 may obtain...

Computer Network Security: Best Practices for Alberta School Jurisdictions.

ERIC Educational Resources Information Center

Alberta Dept. of Education, Edmonton.

This paper provides a snapshot of the computer network security industry and addresses specific issues related to network security in public education. The following topics are covered: (1) security policy, including reasons for establishing a policy, risk assessment, areas to consider, audit tools; (2) workstations, including physical security,…

Cyber-Physical Attack-Resilient Wide-Area Monitoring, Protection, and Control for the Power Grid

DOE Office of Scientific and Technical Information (OSTI.GOV)

Ashok, Aditya; Govindarasu, Manimaran; Wang, Jianhui

Cyber security and resiliency of Wide-Area Monitoring, Protection and Control (WAMPAC) applications is critically important to ensure secure, reliable, and economic operation of the bulk power system. WAMPAC relies heavily on the security of measurements and control commands transmitted over wide-area communication networks for real-time operational, protection, and control functions. Also, the current “N-1 security criteria” for grid operation is inadequate to address malicious cyber events and therefore it is important to fundamentally redesign WAMPAC and to enhance Energy Management System (EMS) applications to make them attack-resilient. In this paper, we propose an end-to-end defense-in-depth architecture for attack-resilient WAMPAC thatmore » addresses resilience at both the infrastructure layer and the application layers. Also, we propose an attack-resilient cyber-physical security framework that encompasses the entire security life cycle including risk assessment, attack prevention, attack detection, attack mitigation, and attack resilience. The overarching objective of this paper is to provide a broad scope that comprehensively describes most of the major research issues and potential solutions in the context of cyber-physical security of WAMPAC for the power grid.« less

SecureCPS: Defending a nanosatellite cyber-physical system

NASA Astrophysics Data System (ADS)

Forbes, Lance; Vu, Huy; Udrea, Bogdan; Hagar, Hamilton; Koutsoukos, Xenofon D.; Yampolskiy, Mark

2014-06-01

Recent inexpensive nanosatellite designs employ maneuvering thrusters, much as large satellites have done for decades. However, because a maneuvering nanosatellite can threaten HVAs on-­orbit, it must provide a level of security typically reserved for HVAs. Securing nanosatellites with maneuvering capability is challenging due to extreme cost, size, and power constraints. While still in the design process, our low-­cost SecureCPS architecture promises to dramatically improve security, to include preempting unknown binaries and detecting abnormal behavior. SecureCPS also applies to a broad class of cyber-­physical systems (CPS), such as aircraft, cars, and trains. This paper focuses on Embry-­Riddle's ARAPAIMA nanosatellite architecture, where we assume any off-­the-­shelf component could be compromised by a supply chain attack.1 Based on these assumptions, we have used Vanderbilt's Cyber Physical -­ Attack Description Language (CP-­ADL) to represent realistic attacks, analyze how these attacks propagate in the ARAPAIMA architecture, and how to defeat them using the combination of a low-­cost Root of Trust (RoT) Module, Global InfoTek's Advanced Malware Analysis System (GAMAS), and Anomaly Detection by Machine Learning (ADML).2 Our most recent efforts focus on refining and validating the design of SecureCPS.

NNSA Administrator Addresses the Next Generation of Nuclear Security Professionals: Part 2

ScienceCinema

Thomas D'Agostino

2017-12-09

Administrator Thomas DAgostino of the National Nuclear Security Administration addressed the next generation of nuclear security professionals during the opening session of todays 2009 Department of Energy (DOE) Computational Science Graduate Fellowship Annual Conference. Administrator DAgostino discussed NNSAs role in implementing President Obamas nuclear security agenda and encouraged the computing science fellows to consider careers in nuclear security.

NNSA Administrator Addresses the Next Generation of Nuclear Security Professionals: Part 1

ScienceCinema

Thomas D'Agostino

2017-12-09

Administrator Thomas DAgostino of the National Nuclear Security Administration addressed the next generation of nuclear security professionals during the opening session of todays 2009 Department of Energy (DOE) Computational Science Graduate Fellowship Annual Conference. Administrator DAgostino discussed NNSAs role in implementing President Obamas nuclear security agenda and encouraged the computing science fellows to consider careers in nuclear security.

FPGA implementation cost and performance evaluation of IEEE 802.11 protocol encryption security schemes

NASA Astrophysics Data System (ADS)

Sklavos, N.; Selimis, G.; Koufopavlou, O.

2005-01-01

The explosive growth of internet and consumer demand for mobility has fuelled the exponential growth of wireless communications and networks. Mobile users want access to services and information, from both internet and personal devices, from a range of locations without the use of a cable medium. IEEE 802.11 is one of the most widely used wireless standards of our days. The amount of access and mobility into wireless networks requires a security infrastructure that protects communication within that network. The security of this protocol is based on the wired equivalent privacy (WEP) scheme. Currently, all the IEEE 802.11 market products support WEP. But recently, the 802.11i working group introduced the advanced encryption standard (AES), as the security scheme for the future IEEE 802.11 applications. In this paper, the hardware integrations of WEP and AES are studied. A field programmable gate array (FPGA) device has been used as the hardware implementation platform, for a fair comparison between the two security schemes. Measurements for the FPGA implementation cost, operating frequency, power consumption and performance are given.

[Chemical, physical and biological risks in law enforcement].

PubMed

Magrini, Andrea; Grana, Mario; Vicentini, Laura

2014-01-01

Chemical, physical and biological risks among public safety and security forces. Law enforcement personnel, involved in routine tasks and in emergency situations, are exposed to numerous and several occupational hazards (chemical, physical and biological) whith likely health and security consequences. These risks are particularly high when the organization and preparation are inadequate, there is a lacking or insufficient coordination, information, education and communication and safety and personal protective equipment are inadequate or insufficient. Despite the objective difficulties, caused by the actual special needs related to the service performed or the organizational peculiarities, the risk identification and assessment is essential for worker health and safety of personnel, as provided for by Legislative Decree no. 81/2008. Chemical risks include airborne pollutants due to vehicular traffic (carbon monoxide, ultrafine particles, benzene, polycyclic aromatic hydrocarbons, aldehydes, nitrogen and sulfur oxides, lead), toxic gases generated by combustion process following fires (aromatic hydrocarbons, PAHs, dioxins and furans, biphenyls, formaldehyde, metals and cyanides), substances emitted in case of chemical accidents (solvents, pesticides, toxic gases, caustics), drugs (methylamphetamine), riot control agents and self-defence spray, lead at firing ranges, and several materials and reagents used in forensic laboratory. The physical hazards are often caused by activities that induce biomechanical overload aid the onset of musculoskeletal disorders, the use of visual display terminals and work environments that may expose to heat stress and discomfort, high and low pressure, noise, vibrations, ionizing and non-ionizing radiation. The main biological risks are blood-borne diseases (viral hepatitis, AIDS), airborne diseases (eg, tuberculosis, meningitis, SARS, anthrax), MRSA, and vector-borne diseases. Many of these risk factors are unavoidable or are not predictable; so a proper risk assessment is very important, especially in case of emergencies, and also the necessary preventive measures, a careful analysis of alternative options for action and decision-making, implementation of security measures due to the provision of appropriate PPE and effective management of risk communication have great importance. Another important aspect is the education and training of staff, as in emergency situations should be able to take protective measures as quickly as possible.

Printable, scannable biometric templates for secure documents and materials

NASA Astrophysics Data System (ADS)

Cambier, James L.; Musgrave, Clyde

2000-04-01

Biometric technology has been widely acknowledged as an effective means for enhancing private and public security through applications in physical access control, computer and computer network access control, medical records protection, banking security, public identification programs, and others. Nearly all of these applications involve use of a biometric token to control access to a physical entity or private information. There are also unique benefits to be derived from attaching a biometric template to a physical entity such as a document, package, laboratory sample, etc. Such an association allows fast, reliable, and highly accurate association of an individual person's identity to the physical entity, and can be used to enhance security, convenience, and privacy in many types of transactions. Examples include authentication of documents, tracking of laboratory samples in a testing environment, monitoring the movement of physical evidence within the criminal justice system, and authenticating the identity of both sending and receiving parties in shipment of high value parcels. A system is described which combines a biometric technology based on iris recognition with a printing and scanning technology for high-density bar codes.

36 CFR 1008.6 - Assuring integrity of records.

Code of Federal Regulations, 2010 CFR

2010-07-01

... subject to the Privacy Act be maintained with appropriate administrative, technical and physical...) Records security. Whether maintained in physical or electronic form, records subject to the Privacy Act... the system of records. The Privacy Act Officer will periodically review these security measures to...