Construction Methodology of Information Security System of Banking Information in Automated Banking Systems

Abstract

The monograph presents modern methodology of building information security systems of banking information systems. The methodology is based on a new concept of building a threat model, constructed on synergistic principles. As a result, for the first time a three-tier security model of strategic management of banking information technologies has being built for the automated banking system. This system takes into account threats of cybersecurity, information security and threats for the security of banking information at the same time. Special attention should be given to the methods proposed in the monograph to ensure the confidentiality, integrity and authenticity of information in banking information systems. In contrast to the known ones, the proposed methods are built on hybrid cryptographic structures with redundant codes. Principles of the methods are mathematical models of hybrid cryptocodic constructions with using asymmetric crypto-modified McEliece and Niederreiter codes and modified geometric codes. The book is full of applied examples that confirm the validity of the developed methods and the adequacy of the proposed models. In this way a comprehensive solution has been proposed from a systemic position on the base of a synergistic approach, to ensure the information security of banking information systems. The proposed methodology opens up the new methods to building security systems for the critical information infrastructures of the state and business which is new in terms of security and a rational in terms of money spent The results are proposed to be used at planning measures to ensure the information security of automated banking systems for minimization of risks from new threats to the security of banking information. The monograph will be useful for researchers and applicants for scientific degrees, and can also be used by students during training to raise awareness of information and cybersecurity issues of modern information technologies.

Mathematical Models of Hybrid Crypto Code Constructions on Damaged Codes

“…The next step, he must enter the OTP token (OTP -One-time Password Algorithm), usually sent by SMS to his mobile device. OTP will be available only to those who are supposed in theory, introduced the available third-party password [23]. Methods strict (two-factor) authentication is often used in the financial sector, but in principle can be applied in almost any other field.…”

“…1. Given in [23] multifactor authentication methods analysis showed the following major advantages and disadvantages: -The advantages of the methods based on SMS -you notifications OTP generation-codes at each entrance and transfer to additional channels, intercept login and password on the main channel will not lead to the attacker bank client information. Binding OTPpassword to the phone numbers.…”

“…-Bar-Passwindow system codes provide unique static image sequence of characters generated dynamically authentication server without encryption algorithms.Anyinterference pattern or fake bar-code is passively presented to the user in the form of combinations appearance in a pattern that does not meet expectations. A major drawback is the possibility of a unique selection bar-code card proposed in [23].…”

“…The analysis of threats [23][24][25][26][27][28][29] indicates a significant transformation and their hybridity. From a purely threats IS, CB, SI infrastructure ABS, displays signs of hybridity threat began to occur as a result of simultaneous action on the object of protection -SI in ABS by the emergence of the phenomenon of synergism [24].…”

“…Threats to the security of the network ABS can be divided into network attacks (information coming from the remote agent) and local attacks originating from malware already installed on the client system, such as Trojans, rootkits, and so on. Often authentication security assessment focused primarily on network attacks suggesting that the terminal (ie, desktop computer, laptop or mobile device) is protected platform [23]. However, often the attacker has full access to the victim's computer through the hidden processes of communication that remained from malware using uncorrected security holes licensed software.…”