The need for virtual information managers in education

In this paper, the authors analyse how educational institutions behave in relation with the contents available through the Web. They also reflect on the features of the currently available information managers, from an educational point of view. They found there is a lack of tools for information management at low scale when it has to be used as a resource for teaching and learning whether at secondary or university level. Finally, they propose a solution, which consists of naming a ‘small virtual educational library’ (SVEL), and they show how it works in Physics education context.     

大学生网络信息安全教育探析简

现如今,伴随我国网络信息化步伐的加快,在高校强化对大学生的网络信息安全教育意义重大、影响深刻。本文通过分析高校学生开展网络信息安全教育的必要性及暴露的问题,就今后大学生进行网络信息安全教育工作提出若干可行性见解。     

网络空间安全大类下的信息安全专业人才培养

围绕在大类通识培养模式下如何保证信息安全专业本科人才的培养质量问题展开讨论，通过对信息安全专业特性及知识结构深入分析，提出了专业课程融合、安全思维培养、互联网+翻转课堂教学模式等针对性解决方案。     

企业信息安全工作实践

信息安全的重要性越来越受到国家和企业的重视,信息安全等级保护相关规范的出现,给各个企业的信息安全工作提供了一个很好的抓手,企业应该针对不同的信息系统,按照要求从定级、备案、安全建设和整改、等级测评五个方面入手开展企业信息安全工作,不仅能满足国家相关要求,也能从技术和管理两个方面开展工作,搭建企业信息化安全体系架构,提升企业的信息安全整体能力。     

The information security digital divide between information security managers and users

Empirical findings from surveys and in-depth interviews with information security managers and users indicate that a digital divide exists between these groups in terms of their views on and experience of information security practices. Information security professionals mainly regard users as an information security threat, whereas users believe themselves that they are an untapped resource for security work. The limited interaction between users and information security managers results in a lack of understanding for the other's point of view. These divergent views on and interpretations of information security mean that managers tend to base their practical method on unrealistic assumptions, resulting in management approaches that are poorly aligned with the dynamics of the users' working day.     

论网络信息安全的信息管理

当前,保证网络信息安全是促进信息管理的前提,在计算机网络信息管理中占有拳足轻重的地位笔者结合自身工作实践,在本文中阐述了网络信息安全管理的概念及分类,分析了当前网络信息的安全问题,并在此基础上,提出了进一步加强信息管理的对策措施,以期对业内同行有所参考借鉴。     

Managing network security: Security education in the information age

Computing operates in an almost universally networked environment, but the technical aspects of information protection have not kept up. As a result, the success of information security programs has increasingly become a function of our ability to make prudent management decisions about organizational activities. Managing Network Security takes a management view of protection and seeks to reconcile the need for security with the limitations of technology.     

The fundamentals of information security

Some quality models, such as IS0 9126, fail to include computer security. The author explains why security is an essential but difficult facet of quality. As a software professional, you can take several actions to improve the security of your code: (1) learn the techniques of security; (2) when incorporating security features into a system, think like the attacker, i.e. consider each point as a potential weakest link; and, finally, (3) consult an expert     

The configuration and detection strategies for information security systems

Intrusion Detection Systems (IDSs) have become an important element of the Information Technology (IT) security architecture by identifying intrusions from both insiders and outsiders. However, security experts questioned the effectiveness of IDSs recently. The criticism known as Base Rate fallacy states that when IDS raises an alarm, the event is more likely to be benign rather than intrusive since the proportion of benign activity is significantly larger than that of intrusive activity in the user population. In response to too many false alarms, system security officers (SSO) either ignore alarm signals or turn off the IDS as the information provided by IDS is very skeptical. To alleviate this problem of IDSs, Ogut et al. (2008) [6] suggest that the firm may choose to wait to get additional signal and to make better decision about user type. One of the limitations of their model is that configuration point at which IDSs operate (the false negative and false positive rates) is exogenously given. However, the firm trying to minimize expected cost should also make a decision regarding the configuration level of IDSs since these probabilities are one of the determinants of future cost. Therefore, we extend Ogut et al. (2008) [6] by considering configuration and waiting time decisions jointly in this paper. We formulate the problem as dynamic programming model and illustrate the solution procedure for waiting time and configuration decision under optimal policy when cost of undetected hacker activity follows step wise function. As it is difficult to obtain waiting time and configuration decision under optimal policy, we illustrate the solution procedures for under myopic policy and focus on the characteristics of configuration decision under myopic policy. Our numerical analysis suggested that configuration decision is as important as waiting time decision to decrease the cost of operating IDS.     

加密技术下的信息安全

计算机和通信网络的广泛应用,一方面为人们的生活和工作带来了极大的方便,另一方面也带来了许多亟待解决的问题,以“棱镜门”事件为例,信息的安全性就是其中的重中之重.信息安全性主要体现在两个方面:信息的保密性和认证性.保密性的目的是防止对手破译系统中的机密信息.认证的目的主要有两个,一个是验证信息发送者是真的而不是冒充的;另一个是验证信息的完整性,即信息在传输和处理的过程中没有被篡改.加密技术是保证信息安全的关键技术,常用的加密技术有:对称密钥加密、公开密钥加密、哈希函数加密等,其应用有:数字认证及授权,安全协议等.而一系列的加密技术都依赖于密码学技术.本文将主要通过对密码学及各种加密技术的研究与分析,来论述加密技术与信息安全之间的不可分割的关系及应用.     

Value conflicts for information security management

A business’s information is one of its most important assets, making the protection of information a strategic issue. In this paper, we investigate the tension between information security policies and information security practice through longitudinal case studies at two health care facilities. The management of information security is traditionally informed by a control-based compliance model, which assumes that human behavior needs to be controlled and regulated. We propose a different theoretical model: the value-based compliance model, assuming that multiple forms of rationality are employed in organizational actions at one time, causing potential value conflicts. This has strong strategic implications for the management of information security. We believe health care situations can be better managed using the assumptions of a value-based compliance model.     

信息安全实验平台技术

围绕信息安全实验平台建设,探讨相关的内容和技术,并通过比较说明OSI参考模型和安全服务及安全机制的对应关系,分析实验平台的服务功能和技术支持,提出信息安全实验平台的参考框架,可以为师生创造一个内容丰富、功能稳定、安全真实的实验环境.