Q23 You have been appolnted as a Head of Secure Software consultant fo (1).docx

•Download as DOCX, PDF•

0 likes•4 views

Q23 You have been appolnted as a Head of Secure Software consultant for a new student information system (SIS) development project for the Univeraiti Tun Hussein Onn Malaysla (UTHM). SIS will be developed as both web-based and moblle-based system. SIS development applied Development, Security, and Operations (Devsecops) model as project methodology. The syatem's modules involve Student Record Maragement, Attendance, Exam Reaulta, Transcripts, Medical Record, Class Schedules, Awards, and Student Dashboards. Based on the scenario, answer the following questions: (a) Identify TWO (2) potential sccurity risks for cach of the element in the STRIDE model for the mobile-based system. (12 marks) (b) Propose an input validation flowchart to validate input from students registration. Assume the inputs are: Student Name, Address (Street Name, Clly, state/Province, Postcode), Identity Card Number, Date of Bitth, Matric Card Number, Contact Number, and Program Hame. ( 8 marks) .

Education

This document contains the resume of Dr. Charles Pak, which includes the following key details: - Dr. Pak has over 30 years of experience in cybersecurity and holds several certifications including CISSP, CISM, and CRISC. He has a Ph.D. in Information Assurance and teaches cybersecurity courses. - Currently Dr. Pak works as a Senior Cybersecurity Solution Architect, where he develops cybersecurity solutions for federal agencies and commercial clients. - Prior to his current role, Dr. Pak held positions including Cybersecurity Director and Technical Program Manager, where he managed cybersecurity contracts and conducted security assessments for organizations.

Application Threat Modeling In Risk Management

Mel Drews

Smart Portal: A Platform for Student's Profile Creation, Evaluation and Clust...

vivatechijri

In today's era where almost everything is digitized, even then at the end of the day we have to come across the paperwork when it comes to document submission and verification for any process. As a result, with increased advancement in the technology, easy availability and access of data and documents is the main concern. This project is intended to develop an application based system where student data and documents will be stored on a server and create a smart profile on the basis of student data. Student can also use that data and document anywhere anytime. The main aim is to provide a common application for all parts of education. Where each necessary details and document of a student will be available on one single portal also can be accessible by other higher authorities. Additionally, evaluating the profile and clustering of students can be done for better recommendation. The Smart Portal system will be useful in document extraction during the admission process as well as it will be used for requirement of details and document of a candidate during interview. Students can upload their data and documents on the server after registration. Then their data will be analysed by the system by evaluating and clustering. This data is retrieved using QR code scanning system or Email verification/ OTP.

2020 sept version-1-resume-wonghuishin_career_research

Hui-Shin Wong

Sudharmendra's Resume_02.pdf

Prity Khastgir IPR Strategic India Patent Attorney Amplify Innovation

AboutAbout As a Machine Learning Engineer, I am enthusiastic about exploring the fascinating field of machine learning and its potential applications in solving real-world problems. I have a good amount of knowledge in mathematics, statistics, and computer science, which enables me to understand and implement the fundamental concepts and techniques of machine learning. My experience includes working with various data analytics tools and technologies, such as SQL, Python, Tableau, and Power BI. I have developed expertise in data cleaning and exploratory data analysis, statistical inference, and machine learning techniques such as regression, and clustering, my experience also includes working with a variety of machine learning tools and frameworks, including, Scikit-learn, TensorFlow and Keras. I have also developed expertise in data pre-processing, feature engineering, and model selection, which has enabled me to create robust and accurate machine-learning models. I am eager to expand my knowledge and expertise in machine learning research and AI-related fields. I am a quick learner, and I am always willing to take on new challenges and stretch myself to develop new skills. Furthermore, I am a good communicator and collaborator, able to work effectively in a team and learn from more experienced colleagues. I am excited about the potential of machine learning to create positive change and improve people's lives specifically in Health Care industries. I am committed to staying up-to-date with the latest developments in machine learning and related fields, attending conferences and workshops, and engaging in continuous learning. I am eager to apply my skills and experience to solve complex problems and create value for organizations. https://www.linkedin.com/in/sudharmendra-gv-7214361b2/ Machine Learning EngineerMachine Learning Engineer Longevity InTime BioTech · Part-timeLongevity InTime BioTech · Part-time Nov 2022 - Present · 6 mosNov 2022 - Present · 6 mos Wilmington, Delaware, United StatesWilmington, Delaware, United States Longevity Intime is a company developing online technology, which enables early diagnosis of diseases using real-time biometrics from the human body. The Longevity InTime team includes experienced biotechnologists, award-winning scientists, developers, and experienced executives with years of experience. Together we are solving the global problem of life expectancy for each person and for all mankind. Our goal is to extend a person's life by more than 20 active and happy years without any restrictions to him. We respond to both the personal and public interests of every country on Earth.Longevity Intime is a company developing online technology, which enables early diagnosis of diseases using real-time biometrics from the human body. The Longevity InTime team includes experienced biotechnologists, award-winning scientists, developers, and experienced executives with years of experience.

vikash kumar

VIKASH KUMAR

Vikash Kumar is a network security engineer with over 2 years of experience in vulnerability management, IDS/IPS systems, security information and event management (SIEM), and anti-virus software. He has a Master's degree in Computer Networking and a Bachelor's degree in Information Science and Engineering. His technical skills include Windows operating systems, firewalls, routers, vulnerability scanning, and security systems such as IBM Proventia, Check Point IPS, ArcSight, Qualys Guard, and Symantec antivirus. He is proficient in networking protocols and has experience implementing security projects.

Information Security Management in University Campus Using Cognitive Security

CSCJournals

Nowadays, most universities offer free Internet connections, access to scientific databases, and advanced computer networks for the members of their community, which generates dynamic and complex scenarios. In this context, it is necessary to define proactive security strategies, as well as the integration of technology and research. This work presents a general vision of the experience adopted by the universities in the field of information security management using cognitive security.

SECURING THE DIGITAL FORTRESS: ADVERSARIAL MACHINE LEARNING CHALLENGES AND CO...

IRJET Journal

This document discusses adversarial machine learning challenges and countermeasures in cybersecurity. It begins by introducing the topic of adversarial machine learning and its threats to cybersecurity systems that incorporate machine learning models. It then reviews related literature on adversarial attacks against machine learning systems. The document explores different types of adversarial attacks, such as evasion attacks and poisoning attacks, and provides real-world examples. It also discusses the motivations and goals of adversaries launching these attacks. Finally, it delves into common attack algorithms and methods used to generate adversarial examples.

Most of the Jordanian universities’ inquiries systems, i.e. educational, financial, administrative, and research systems are accessible through their campus networks. As such, they are vulnerable to security breaches that may compromise confidential information and expose the universities to losses and other risks. At Jordanian universities, security is critical to the physical network, computer operating systems, and application programs and each area has its own set of security issues and risks. This paper presents a comparative study on the security systems at the Jordanian universities from the viewpoint of prevention and intrusion detection. Robustness testing techniques are used to assess the security and robustness of the universities’ online services. In this paper, the analysis concentrates on the distribution of vulnerability categories and identifies the mistakes that lead to a severe type of vulnerability. The distribution of vulnerabilities can be used to avoid security flaws and mistakes.

Secured cloud support for global software

ijseajournal

This document summarizes a research paper that proposes a methodology called TSPS (Theory/SWEBOK/Project Security) to improve software engineering education. The methodology aims to collaborate between academic and industrial practices. It involves students working on projects with guidance from both mentors and industry practitioners. Data from literature reviews on software security engineering education is analyzed. A cloud-based system is developed to securely store project documents by encrypting and splitting files across multiple cloud nodes. The methodology and secure cloud storage approach are concluded to provide strategies to mitigate risks in software projects and benefit both education and industry.

A SYSTEMATIC REVIEW ON MACHINE LEARNING INSIDER THREAT DETECTION MODELS, DATA...

IJNSA Journal

Computers are crucial instruments providing a competitive edge to organizations that have adopted them. Their pervasive presence has presented a novel challenge to information security, specifically threats emanating from privileged employees. Various solutions have been tried to address the vice, but no exhaustive solution has been found. Due to their elusive nature, proactive strategies have been proposed of which detection using Machine Learning models has been favoured. The choice of algorithm, datasets and metrics are cornerstones of model performance and hence, need to be addressed. Although multiple studies on ML for insider threat detection have been done, none has provided a comprehensive analysis of algorithms, datasets and metrics for development of Insider Threat Detection models. This study conducts a comprehensive systematic literature review using reputable databases to answer the research questions posed. Search strings, inclusion and exclusion criteria were set for eligibility of articles published in the last decade.

vijay

Vijay Kumar

Vijay Kumar is seeking a career that offers challenges and growth opportunities to further develop his knowledge and skills. He has a Master's degree in Computer Science and Engineering from Central University of Rajasthan with a specialization in Information Security. He has over 2.5 years of teaching experience and his research interests include information security, cryptography, and cloud computing. He has published papers in conferences and completed projects related to cloud platforms and student databases. His referees include professors from Central University of Rajasthan.

An Effective Cybersecurity Awareness Training Model: First Defense of an Orga...

IRJET Journal

This document discusses the importance of cybersecurity awareness training for organizations and proposes an effective training model. It analyzes how artificial intelligence (AI) can enhance security awareness programs. Specifically, it examines the Technology Acceptance Model (TAM) and how AI-enabled tools like the viCyber system can help design training based on the National Initiative for Cybersecurity Education (NICE) framework. The study concludes that regular, comprehensive security awareness training is critical to address the human factors that can weaken an organization's cyber defenses. AI tools show promise in developing trainings but require further evaluation of their usability and reliability.

Building a Distributed Secure System on Multi-Agent Platform Depending on the...

CSCJournals

Today, applications in mobile multi-agent systems require a high degree of confidence that running code inside the system will not be malicious. Also any malicious agents must be identified and contained. Since the inception of mobile agents, the intruder has been addressed using a multitude of techniques, but many of these implementations have only addressed concerns from the position of either the platform or the agents. Very few approaches have undertaken the problem of mobile agent security from both perspectives simultaneously. Furthermore, no middleware exists to facilitate provisioning of the required security qualities of mobile agent software while extensively focusing on easing the software development burden. The aim is to build a distributed secure system using multi-agents by applying the principles of software engineering. The objectives of this paper is to introduce multi agent systems that enhance security rules through the access right to building a distributed secure system integrating with principles of software engineering system life cycle, as well as satisfy the security access right for both platform and agents to improve the three characteristics of agents adaptively, mobility and flexibility. This project based on the platform of PHP and MYSQL (Database) which can be presented in a website. The implementation and test are applied in both Linux and Windows platforms, including Linux Red Hat 8, Linux Ubuntu 6.06 LTS and Microsoft Windows XP Professional. Since PHP and MySQL are available in almost all operating systems, the result could be tested the platform as long as PHP and MySQL configuration is available. PHP5 and the MySQL (database) software are used to build a secure website. Multiple techniques of security and authentications have been used by multi-agents system. Secure database is encrypted by using md5. Also satisfy the characteristics for security requirements: confidentiality (protection from disclosure to unauthorized persons), integrity (maintaining data consistency) and authentication (assurance of identity of person or originator of data).

Software Security Engineering

Marco Morana

The document discusses approaches to building secure web applications, including establishing software security processes and maturity levels. It covers security activities like threat modeling, defining security requirements, secure coding standards, security testing, and metrics. Business cases for software security focus on reducing costs of vulnerabilities, threats to web apps, and root causes being application vulnerabilities and design flaws.

Exploration Draft Document- CEM Machine Learning & AI Project 2018

Leslie McFarlin

A Bring Your Own Device Risk Assessment Model

CSCJournals

Bring Your Own Device (BYOD), a technology where individuals or employees use their own devices on the organization’s network to perform tasks assigned to them by the organization has been widely embraced. The reasons for adoption are diverse in every organization. In spite of the security control strategies implemented by these organizations to safeguard their information resources, there has been an upsurge in information security breaches as a result of existing vulnerabilities in these systems and the legacy systems in use. Various approaches have been employed to deal with security challenges in BYOD, but according to literature, risk assessment has proved to be the first key step towards improving security of the BYOD environment in an enterprise. Risk assessment models have been proposed by various researchers, although, most are largely influenced by the degree of technological advancement and utilization as well as the working cultures within institutions. The existing models were largely developed in technologically advanced countries and thus do not fit well in developing countries. This study sought to develop flexible BYOD risk assessment model that can be adopted by varied institutions to secure their information resources. The study was carried out in Five (5) purposively selected state universities in Kenya. The research adopted a mixed research design approach with mixed sampling technique utilized to select the participants. Reliability and validity of data collection tools were evaluated and recommended by IT security and network experts. The qualitative and quantitative data was collected by interviewing experts and administering a questionnaire to sampled participants. The developed model was validated both statistically and by experts. The findings revealed that threats and vulnerabilities contributed to 39.9% and 69.2% respectively to the risk of the BYOD environment while Data Encryption (DE) and Software Updates (SU) came out strongly as intervening variables which have a major impact on the relationship between the dependent and independent variables.

Top 10 Cited Network Security Research Articles 2021 - 2022

IJNSA Journal

The International Journal of Network Security & Its Applications (IJNSA) is a bi monthly open access peer-reviewed journal that publishes articles which contribute new results in all areas of the computer Network Security & its applications. The journal focuses on all technical and practical aspects of security and its applications for wired and wireless networks. The goal of this journal is to bring together researchers and practitioners from academia and industry to focus on understanding Modern security threats and countermeasures, and establishing new collaborations in these areas.

Security Introspection for Software Reuse

IRJET Journal

1) The document examines the relationship between software reuse and security vulnerabilities by analyzing 1244 open-source projects. 2) The results indicate that the number of potential vulnerabilities in native and reused code is related to the scale of development. Additionally, the number of dependencies is closely related to the number of vulnerabilities. 3) Software reuse is neither a panacea that fully addresses vulnerabilities nor does it inherently lead to an excessive number; the relationship between reuse and security vulnerabilities depends on factors like the scale of the project.

STAYING SAFE AND SECURED ON TODAY AND TOMORROW’S AFRICA CYBERSPACE WORKSHOP 2017

Maurice Dawson

This is the most essential programme of the year around the dangers of cybercrime and how to manage safety within the most indispensable digital sphere & technology system. The reason is that, “Looking beyond Internet of Things (IoT) to Internet of Everything there is a potential market that is approximately $14.4 trillion and over 99% of physical devices are still unconnected.” ~Mo Dawson. Your participation give you golden access to a transcending Cyberspace picture, enhanced solution oriented capabilities as an ICT expert or practitioner, Telecommunications Corporates & Companies Personnel, Aviation ICT Officials, Other Transportation controls network hubs, Business dealer in Cyberspace services provider or supplier, Academicians and researchers, Government Departments & Public service ICT systems Officials & staff, Students, general ICT security involvement and on top of that your enhanced multidimensional scope & prosperity out of this untapped gold mine is guaranteed.

Cyber Security Models - CxT Group

CXT Group

Automatic Insider Threat Detection in E-mail System using N-gram Technique

IRJET Journal

This document summarizes research on automatic insider threat detection in email systems using n-gram techniques. It discusses how n-grams can be used to classify documents and detect potential data leakage through email. The system would verify emails sent outside the network using SHA, n-grams and thresholds. If a threat is detected, the user would be blocked. The document also provides a literature review on 10 other papers related to insider threat detection using methods like user profiling, activity logs, data mining and visualization techniques. It describes how n-grams work by breaking words into character sequences and creating profiles based on frequency to classify documents.

Network Intrusion Detection using MRF Technique

Associate Professor in VSB Coimbatore

With the advent of the internet, cyber-attacks are changing rapidly and the security situation on the internet is not always optimistic. Machine Learning (ML) and In-depth Learning (DL) methods for community-based access to entry and present a quick teaching definition of the entire ML/DL method. Representative papers all the way have been listed, read, and summarized primarily based on their temporary or thermal interactions. Because information is critical to ML/DL strategies, it describes the amount of commonly used public databases used in ML/DL, discusses the complexities of using ML/DL for Internet protection and provides guidelines for course guides. KDD a set of information is a symbol of standing that is widely recognized within the study of the Acquisition strategies. A lot of work is underway to develop innocent identification strategies as information courses used to read and test the diagnostic version are equally problematic because high-quality information can improve offline access. This paper provides a KDD knowledge test set by recognizing the 4 Basic Courses, Content, Traffic and Handling in which all information attributes can be categorized using the Modified Random Forest (MRF). The test was completed by identifying the remaining 2 metric metrics, Visual Rate (DR) and False Noise Scale (FAR) of the Intervention Detection System (IDS). As a result of this evidence-based evaluation of the data set, the contribution of all 4 character studies in DR and FAR has been proven to help determine the validity of the information set.

THE MESA SECURITY MODEL 2.0: A DYNAMIC FRAMEWORK FOR MITIGATING STEALTH DATA ...

IJNSA Journal

The rising complexity of cyber threats calls for a comprehensive reassessment of current security frameworks in business environments. This research focuses on Stealth Data Exfiltration (SDE), a significant cyber threat characterized by covert infiltration, extended undetectability, and unauthorized dissemination of confidential data. Our findings reveal that conventional defense-in-depth strategies often fall short in combating these sophisticated threats, highlighting the immediate need for a shift in information risk management across businesses. The evolving nature of cyber threats, driven by advancements in techniques, such as social engineering, multi-vector attacks, and the emergence of Generative AI, underscores the need for robust, adaptable, and comprehensive security strategies. As we continue to navigate this complex landscape, it is crucial that we stay ahead of the curve, anticipating potential threats, and continually updating our defenses to protect against them. We propose a shift from traditional perimeter-based, prevention-focused models, which depend on a static attack surface, to a more dynamic framework that prepares for inevitable breaches. This suggested model, known as ‘MESA 2.0 Security Model’, prioritizes swift detection, immediate response, and ongoing resilience, thereby enhancing an organization’s ability to promptly identify and neutralize threats, significantly reducing the consequences of security breaches. This study suggests that businesses adopt a forward-thinking and adaptable approach to security management, which is crucial for staying ahead of the ever-changing cyber threat landscape. By shifting focus from merely preventing incidents to effectively managing them, organizations can better safeguard their vital digital assets against the increasingly complex tactics used by contemporary cyber adversaries. This study provides valuable insights and a solid strategic framework that aims to steer the development of future security practices and policies to effectively address and mitigate advanced persistent threats.

Cyber security: challenges for society- literature review

IOSR Journals

This document summarizes challenges related to cyber security for society based on a literature review. It discusses how cyber security plays an important role in technology development and internet services. Key challenges include a lack of coordination between security agencies and critical IT infrastructure, as well as widespread computer illiteracy in some countries like India that has led to increased cybercrime. The document also reviews common approaches to IT security risk analysis and discusses threats to cyber security such as cyber attacks aimed at damaging systems and cyber exploitation for unlawful purposes.

Two-Factor_Authentication_1-22-15.pptx

PreethamS41

Two-factor authentication is being implemented at Michigan State University to enhance security. It will require employees to verify their identity using two methods, such as a password and mobile app, when logging into payroll, HR and finance applications on EBS. The goals are to safeguard employee and financial data from phishing attacks, which have compromised credentials in the past. A strategy is outlined to integrate two-factor authentication with MSU's single sign-on system using a mobile app, text messages or phone calls for the second verification factor.

IRJET - Cross-Site Scripting on Banking Application and Mitigating Attack usi...

IRJET Journal

This document summarizes a research paper that proposes using honey encryption to mitigate cross-site scripting attacks on banking applications. Honey encryption is a technique that provides fake encrypted data to attackers who attempt to access accounts with incorrect passwords. The paper aims to implement a banking system with real-time features, prevent fraudulent access to legitimate accounts, and encrypt account details to provide wrong information to unauthorized parties. Challenges include honey encryption not working for small datasets, slow encryption/decryption for large datasets, and potential privacy issues if real data is leaked before users are notified. The paper reviews related work on detecting cross-site scripting, data-driven fuzzing, banking fraud analysis systems, and applying honey encryption to file storage and natural

A Review On Data Security In Cloud Computing

Yolanda Ivey

This document provides a review of approaches for ensuring data security in cloud computing. It summarizes 31 research papers on this topic published between 2007-2014. The key findings are: 1) The majority of approaches (45%) ensured data security through encryption methods like RSA encryption, merging Playfair and Vigenere ciphers with DES, and using SSL encryption. 2) Other common approaches included proposing guidelines (21%) and frameworks (16%) for data security, and using homomorphic tokens (7%) to enable encrypted data comparisons. 3) The approaches were categorized based on the technique used, with encryption being the most frequent, followed by guidelines, frameworks, homomorphic tokens, and other methods like harmonizing

Question 1A) Which of these statements could explain why inverted trop.docx

Q23 You have been appolnted as a Head of Secure Software consultant fo (1).docx

Recommended

Recommended

More Related Content

Similar to Q23 You have been appolnted as a Head of Secure Software consultant fo (1).docx

Similar to Q23 You have been appolnted as a Head of Secure Software consultant fo (1).docx (20)

More from MattMl3Grays

More from MattMl3Grays (20)

Recently uploaded

Recently uploaded (20)

Q23 You have been appolnted as a Head of Secure Software consultant fo (1).docx