<?xml version="1.0" encoding="UTF-8"?><xml><records><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>27</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Venelin Georgiev</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">The ‘Balance’ As a Panacea for Achieving (Cyber)Security</style></title><secondary-title><style face="normal" font="default" size="100%">IT4Sec Reports</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">balance</style></keyword><keyword><style  face="normal" font="default" size="100%">capabilities</style></keyword><keyword><style  face="normal" font="default" size="100%">Cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">panacea</style></keyword><keyword><style  face="normal" font="default" size="100%">risks</style></keyword><keyword><style  face="normal" font="default" size="100%">Scenarios</style></keyword><keyword><style  face="normal" font="default" size="100%">security controls</style></keyword><keyword><style  face="normal" font="default" size="100%">threats</style></keyword><keyword><style  face="normal" font="default" size="100%">Vulnerabilities</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2022</style></year></dates><number><style face="normal" font="default" size="100%">145</style></number><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">Decision-making in a complex, complex, multi-layered and multifactorial environment, such as the security environment, requires a balance between threat factors and strategies to counter them. In this sense, the search for a single, simple solution, seen as a panacea, is an irrational management approach. The report presents the results of a study to develop a model for balancing cybersecurity solutions.
</style></abstract></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>27</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Venelin Georgiev</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Productive and Counter-Productive Balance in Security</style></title><secondary-title><style face="normal" font="default" size="100%">CSDM Views</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">balance</style></keyword><keyword><style  face="normal" font="default" size="100%">capabilities</style></keyword><keyword><style  face="normal" font="default" size="100%">resources</style></keyword><keyword><style  face="normal" font="default" size="100%">Risk</style></keyword><keyword><style  face="normal" font="default" size="100%">security</style></keyword><keyword><style  face="normal" font="default" size="100%">threats</style></keyword><keyword><style  face="normal" font="default" size="100%">Vulnerabilities</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2022</style></year></dates><number><style face="normal" font="default" size="100%">44</style></number><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">The research efforts in the field of security strengthens its relevance in conditions of crises, which are not lacking in modern times. Returning to fundamental questions such as why security is important and what makes it difficult to create an acceptable level of security allows, on the one hand, to reveal some erroneous theses, and on the other hand, to add perspectives in the search for rational answers. The material draws a parallel between two types of security balances, defined as productive and counter-productive. Based on the comparison, challenges to finding balanced solutions to security issues viewed as multifactorial functions are presented.</style></abstract></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>27</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Venelin Georgiev</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">An Organizational Cybersecurity Program</style></title><secondary-title><style face="normal" font="default" size="100%">IT4Sec Reports</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">cybersecurity controls</style></keyword><keyword><style  face="normal" font="default" size="100%">cybersecurity program</style></keyword><keyword><style  face="normal" font="default" size="100%">in-depth protection</style></keyword><keyword><style  face="normal" font="default" size="100%">managing cybersecurity incidents</style></keyword><keyword><style  face="normal" font="default" size="100%">threats</style></keyword><keyword><style  face="normal" font="default" size="100%">Vulnerabilities</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2021</style></year></dates><number><style face="normal" font="default" size="100%">139</style></number><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">&lt;p&gt;Information technologies have irreversibly entered the daily lives of consumers personally and professionally. This technology influx can be accepted as long as security is maintained at a sufficiently high level. The fulfillment of this condition is reflected in the attitude of organizations and users to the security of information systems, networks, applications and information. There are two possible options for ensuring cybersecurity in the organization: ad-hoc approach and systematic approach. This report expounds on the benefits of using a systematic approach in dealing with cybersecurity challenges based on the development, adoption, implementation and updating a dedicated organizational cybersecurity program.&lt;/p&gt;</style></abstract></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Ivan Blagoev</style></author><author><style face="normal" font="default" size="100%">Todor Balabanov</style></author><author><style face="normal" font="default" size="100%">Iliyan Iliev</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">RSA Weaknesses Caused by the Specifics of Random Number Generation</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">cryptography</style></keyword><keyword><style  face="normal" font="default" size="100%">Cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">random numbers gen-eration</style></keyword><keyword><style  face="normal" font="default" size="100%">RSA algorithm</style></keyword><keyword><style  face="normal" font="default" size="100%">Vulnerabilities</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2021</style></year></dates><volume><style face="normal" font="default" size="100%">50</style></volume><pages><style face="normal" font="default" size="100%">171-179 </style></pages><abstract><style face="normal" font="default" size="100%">&lt;p style=&quot;margin-left:19.85pt;&quot;&gt;The rapid entry in digital transformation and Covid-19 moved many activities to the Internet. The application of cybersecurity tools gives a sense of good security condition of the used digital services. This is often how things look on the surface, but the problems sometimes is hard to notice. The current study presents weaknesses in the still widely used cryptographic algorithm RSA, which allows RSA cryptographic keys to be compromised. It demonstrates the connection with RNG as the root of all the resulting controversies around the issues under consideration.&lt;/p&gt;</style></abstract><issue><style face="normal" font="default" size="100%">2</style></issue></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Elisaveta Staneva</style></author><author><style face="normal" font="default" size="100%">Mariyan Rachev</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Tactical Approach to Cyber Defence in IoT Computer Networks</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">architecture</style></keyword><keyword><style  face="normal" font="default" size="100%">authentication</style></keyword><keyword><style  face="normal" font="default" size="100%">Internet of Things</style></keyword><keyword><style  face="normal" font="default" size="100%">security</style></keyword><keyword><style  face="normal" font="default" size="100%">Vulnerabilities</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2020</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2020</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">47</style></volume><pages><style face="normal" font="default" size="100%">135-140</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">Securing Internet of Things’ devices has been an ongoing struggle since the technology's recognition. Finding methods to prevent or counter those threats through the experience of the hackers themselves is a promising way of securing these devices. The approach described in this article uses that experience and transforms it into useful models and algorithms for IoT security.</style></abstract><issue><style face="normal" font="default" size="100%">1</style></issue><section><style face="normal" font="default" size="100%">135</style></section></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>27</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Veselin Monev</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Enterprise IT security metrics: Classification, examples and characteristics (in Bulgarian)</style></title><secondary-title><style face="normal" font="default" size="100%">IT4Sec Reports</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">characteristics</style></keyword><keyword><style  face="normal" font="default" size="100%">classification</style></keyword><keyword><style  face="normal" font="default" size="100%">company</style></keyword><keyword><style  face="normal" font="default" size="100%">expected annual lose</style></keyword><keyword><style  face="normal" font="default" size="100%">incident</style></keyword><keyword><style  face="normal" font="default" size="100%">IT security</style></keyword><keyword><style  face="normal" font="default" size="100%">management</style></keyword><keyword><style  face="normal" font="default" size="100%">matrix</style></keyword><keyword><style  face="normal" font="default" size="100%">measure</style></keyword><keyword><style  face="normal" font="default" size="100%">Metric</style></keyword><keyword><style  face="normal" font="default" size="100%">metrics</style></keyword><keyword><style  face="normal" font="default" size="100%">Risk</style></keyword><keyword><style  face="normal" font="default" size="100%">Vulnerabilities</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2014</style></year><pub-dates><date><style  face="normal" font="default" size="100%">March 2014</style></date></pub-dates></dates><number><style face="normal" font="default" size="100%">111</style></number><publisher><style face="normal" font="default" size="100%">Institute of Information and Communication Technologies</style></publisher><pub-location><style face="normal" font="default" size="100%">Sofia</style></pub-location><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">The report addresses the key issues associated with measuring IT security for private companies. Several classifications of metrics are discussed focusing on the functions of different levels of security management. For the most part, this work examines the pros and cons of common metrics for measuring IT security and provides guidelines for creating own metrics. ‘Own metrics,’ adapted to the corporate environment, are those which security managers have to create and use for the purpose of effective management.</style></abstract></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Todor Tagarev</style></author><author><style face="normal" font="default" size="100%">Venelin Georgiev</style></author><author><style face="normal" font="default" size="100%">Valeri Ratchev</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">A Taxonomy of Essential Services</style></title><secondary-title><style face="normal" font="default" size="100%">Radioelectronic and Computer Systems</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Comprehensive approach</style></keyword><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">Planning</style></keyword><keyword><style  face="normal" font="default" size="100%">risk management</style></keyword><keyword><style  face="normal" font="default" size="100%">security policy</style></keyword><keyword><style  face="normal" font="default" size="100%">threats</style></keyword><keyword><style  face="normal" font="default" size="100%">Uncertainty</style></keyword><keyword><style  face="normal" font="default" size="100%">Vulnerabilities</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2012</style></year><pub-dates><date><style  face="normal" font="default" size="100%">May 2012</style></date></pub-dates></dates><publisher><style face="normal" font="default" size="100%">Radioelectronic and Computer Systems 6(58)</style></publisher><pub-location><style face="normal" font="default" size="100%">Sevastopol, Ukraine</style></pub-location><pages><style face="normal" font="default" size="100%">191-196</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">Communities, countries and alliances cannot be efficient in preparing to meet diverse threats to their security within traditional organizational stovepipes. The boundaries between ‘internal’ and ‘external’ threats are getting fuzzier, and the vulnerabilities of governments, businesses and communities feed on each other, while the comprehensive approach is gaining traction in ever more security fields. The implementation of the comprehensive approach poses a number of methodological challenges. While it clearly requires coordination of various capabilities of a multitude of actors, it is less apparent which is the suitable organising concept. This paper takes as a starting point the concept of ‘essential services’ and suggests a taxonomy, that would allow to treat threats, vulnerabilities and risk in a common comprehensive framework. The taxonomy has been developed with a specific purpose in mind, and thus refers to European Essential Services (EES). We nevertheless reason that it can be replicated to support decision making at other levels, e.g. in national security policy making and planning. </style></abstract><issue><style face="normal" font="default" size="100%">58</style></issue></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Eugene Nickolov</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Critical Information Infrastructure Protection</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Critical Information Infrastructure Protection</style></keyword><keyword><style  face="normal" font="default" size="100%">Information Security</style></keyword><keyword><style  face="normal" font="default" size="100%">Malware Attacks</style></keyword><keyword><style  face="normal" font="default" size="100%">National Cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">Vulnerabilities</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2005</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2005</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">17</style></volume><pages><style face="normal" font="default" size="100%">105-119</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">The article provides a brief description of critical information infrastructure and analyzes the extent to which organizations depend on the proper functioning of banking and financial services, electricity, fuel and water supply networks, as well as information and telecommunication networks. The consequences of attacks on specific elements of these infrastructures are examined, as well as the initiatives and problems that arise with their protection on national and international level. Special attention is paid to the state of critical infrastructure protection in Bulgaria, with analysis of the reasons for its poor level and recommendations for improvement.</style></abstract></record></records></xml>