<?xml version="1.0" encoding="UTF-8"?><xml><records><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Vlad Posea</style></author><author><style face="normal" font="default" size="100%">George Sharkov</style></author><author><style face="normal" font="default" size="100%">Adrian Baumann</style></author><author><style face="normal" font="default" size="100%">Georgios Chatzichristos</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Towards Unified European Cyber Incident and Crisis Management Ontology</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">crisis</style></keyword><keyword><style  face="normal" font="default" size="100%">Cybersecurity Act</style></keyword><keyword><style  face="normal" font="default" size="100%">cybersecurity taxonomy</style></keyword><keyword><style  face="normal" font="default" size="100%">harm</style></keyword><keyword><style  face="normal" font="default" size="100%">incident response</style></keyword><keyword><style  face="normal" font="default" size="100%">Interoperability</style></keyword><keyword><style  face="normal" font="default" size="100%">Ontology</style></keyword><keyword><style  face="normal" font="default" size="100%">Risk Assessment</style></keyword><keyword><style  face="normal" font="default" size="100%">threat</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2022</style></year></dates><volume><style face="normal" font="default" size="100%">53</style></volume><pages><style face="normal" font="default" size="100%">33-44</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">ENISA highlighted the need for a common reporting taxonomy for cybersecurity incidents to be used by cybersecurity analysts across Europe. The analysis of the domain revealed a large number of taxonomies for different areas of the cybersecurity domain (types of attacks, vulnerabilities, sectors, harm), but those needed to be linked together in a model that allows a cybersecurity officer to report and track an incident fast and accurately. The taxonomy should also treat the cybersecurity domain not only from the technical point of view but also from the socio-economical aspect. This document describes the taxonomy, how we propose to use it, and the methodology used to develop it.</style></abstract><issue><style face="normal" font="default" size="100%">1</style></issue><section><style face="normal" font="default" size="100%">33</style></section></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Iosif Androulidakis</style></author><author><style face="normal" font="default" size="100%">Vyacheslav Kharchenko</style></author><author><style face="normal" font="default" size="100%">Andriy Kovalenko</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Imeca-Based Technique for Security Assessment of Private Communications: Technology and Training</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">assessment</style></keyword><keyword><style  face="normal" font="default" size="100%">availability</style></keyword><keyword><style  face="normal" font="default" size="100%">communication</style></keyword><keyword><style  face="normal" font="default" size="100%">confidentiality</style></keyword><keyword><style  face="normal" font="default" size="100%">IMECA</style></keyword><keyword><style  face="normal" font="default" size="100%">integrity</style></keyword><keyword><style  face="normal" font="default" size="100%">PBX</style></keyword><keyword><style  face="normal" font="default" size="100%">Risk</style></keyword><keyword><style  face="normal" font="default" size="100%">threat</style></keyword><keyword><style  face="normal" font="default" size="100%">vulnerability</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2016</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2016</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">35</style></volume><pages><style face="normal" font="default" size="100%">99-120</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">Nowadays, almost everywhere, there are a huge number of privately owned telephone exchanges that serve the communication needs of a private or public entity making connections among internal telephones and linking them to other users in the public telephone network. Such communications cover most vital infrastructures, including hospitals, ministries, police, army, banks, public bodies/authorities, companies, industries and so on. The purpose of this paper is to raise awareness in regards to security and privacy threats present in private communications, helping both users and vendors safeguard their systems.
This article provides an introduction to private branch exchanges (PBXs) and private communications, and a review of relevant threats and vulnerabilities. Finally, one possible approach to assessment of private communications security is presented, along with appropriate taxonomies. Such approach relies on performing gap analysis and is based on the IMECA technique.
</style></abstract><issue><style face="normal" font="default" size="100%">1</style></issue><section><style face="normal" font="default" size="100%">99</style></section></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>27</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Yoana Ivanova</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Policies for the Protection of Critical Infrastructure from Cyber Attacks</style></title><secondary-title><style face="normal" font="default" size="100%">IT4Sec Reports</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">cyberattack</style></keyword><keyword><style  face="normal" font="default" size="100%">Cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">modeling</style></keyword><keyword><style  face="normal" font="default" size="100%">policy</style></keyword><keyword><style  face="normal" font="default" size="100%">Risk</style></keyword><keyword><style  face="normal" font="default" size="100%">simulations</style></keyword><keyword><style  face="normal" font="default" size="100%">threat</style></keyword><keyword><style  face="normal" font="default" size="100%">US</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2014</style></year><pub-dates><date><style  face="normal" font="default" size="100%">December 2014</style></date></pub-dates></dates><number><style face="normal" font="default" size="100%">116</style></number><publisher><style face="normal" font="default" size="100%">Institute of Information and Communication Technologies</style></publisher><pub-location><style face="normal" font="default" size="100%">Sofia</style></pub-location><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">In this paper is addressed in details the policy of the US regarding the issues of cyber security that are contained in Presidential Policy Directive (PPD-21). The tasks that should be solved for evaluation and planning of critical infrastructure protection are clearly defined. The following are specific examples of approaches and means to protect critical infrastructure from cyber attacks.</style></abstract></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>27</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Michael Dimitrov</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Why the Organization Needs Information Security Policy and Programme</style></title><secondary-title><style face="normal" font="default" size="100%">IT4Sec Reports</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">adaptability</style></keyword><keyword><style  face="normal" font="default" size="100%">Information</style></keyword><keyword><style  face="normal" font="default" size="100%">Information Security</style></keyword><keyword><style  face="normal" font="default" size="100%">information security policy</style></keyword><keyword><style  face="normal" font="default" size="100%">information security programme</style></keyword><keyword><style  face="normal" font="default" size="100%">Organization</style></keyword><keyword><style  face="normal" font="default" size="100%">resources</style></keyword><keyword><style  face="normal" font="default" size="100%">threat</style></keyword><keyword><style  face="normal" font="default" size="100%">vulnerability</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2013</style></year><pub-dates><date><style  face="normal" font="default" size="100%">December 2013</style></date></pub-dates></dates><number><style face="normal" font="default" size="100%">109</style></number><publisher><style face="normal" font="default" size="100%">Institute of Information and Communication Technologies</style></publisher><pub-location><style face="normal" font="default" size="100%">Sofia</style></pub-location><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">This report outlines the reasons why each organization needs to adopt an information security policy and an information security programme, emphasising the competitive advantages based on improved adaptation capabilities. First, it examines the concept of information security. On that basis, the author represents possible formulation of organizational objectives. The examination of organizational activities in a competitive context allows to formulate specific ways in which information becomes of utmost significance. The report includes examples demonstrating the need to establish an information security policy and an information security programme, including description of threats and vulnerabilities that, unless adequately managed, could decrease the organizational capabilities to achieve their goals.</style></abstract></record></records></xml>