ASSESSMENT OF THREATS FROM SOFTWARE BACKDOORS IN EMBEDDED SYSTEMS: A COMPREHENSIVE APPROACH BASED ON THE «INFORMATION SECURITY THREAT ASSESSMENT METHODOLOGY»
2026· Informatization and communication· Vol 2· 0 citations
TL;DR
The results of the threat assessment from software backdoors in embedded systems can be used to develop relevant countermeasures against threats, select optimal information protection means during the development and operation of embedded systems, and formulate technical specifications for the enhancement of existing or the creation of advanced information protection means in embedded systems.
Abstract
This article describes the implementation of a comprehensive approach to assessing information security threats concerning a specific class of devices—embedded systems. The article combines regulatory and technical-analytical approaches to evaluating the threats posed by software backdoors in embedded systems. The assessment of the threat from software backdoors in embedded systems is conducted within the framework of the classifications outlined in the «Information Security Threat Assessment Methodology» approved by the Federal Service for Technical and Export Control of Russia on February 5, 2021. Based on the classifications regulated by the methodology concerning the capabilities, tactics, and typical techniques of an attacker, and taking into account the peculiarities of the development and operation of embedded systems, the threat from software backdoors for this class of devices is assessed. As a result of the technical analysis, potential sources of information for an attacker implementing information-gathering tactics are detailed, and clustering is performed by network type for the tactics employed by the attacker to gain initial access to system components and networks using various techniques. The results of the threat assessment from software backdoors in embedded systems can be used to develop relevant countermeasures against threats, select optimal information protection means during the development and operation of embedded systems, and formulate technical specifications for the enhancement of existing or the creation of advanced information protection means in embedded systems.
The authors analyze the limitations of existing approaches when applied in isolation, noting the insufficient specification of the FSTEC methodology, the lack of prioritization mechanisms in the MITRE ATT&CK knowledge base, and the subjectivity of the quantitative assessments of the DREAD model. As a solution, they propose a comprehensive methodology based on the mathematical formalization of the integration of these three frameworks. The developed approach includes an algorithm for mapping threats from the FSTEC database to MITRE ATT&CK attack techniques and uses adapted DREAD metrics to rank risks based on existing protective measures. The practical significance of the study lies in the presentation of a step-by-step implementation algorithm, including asset inventory, security audit, and security budget optimization, making the tool applicable to organizations of all sizes.
E. G. Balenko, M. Mitrofanov, N. N. Kramskoy et al.· SOFT MEASUREMENTS AND COMPUT...· 0 citations
This review's results show that penetration testing is an important part of improving cybersecurity because it helps identify weaknesses before they become problems and reduces risk.
The paper presents a formalization of a methodology for analyzing information security threats to critical information infrastructure (CII) objects based on the application of digital twins. A digital twin automata model is proposed, built on the algebra of finite state machines (DTA), which allows describing the behavior of physical and virtual assets and their composition into a single cyber-physical system. The operations of direct product, superposition, and system composition are defined to model component interactions and attack propagation processes. The relationship between the formal automata model and the stages of the threat analysis methodology is established: from system formalization and digital twin construction to attack simulation, threat detection, prioritization, protection adaptation, and model verification. A logical architecture of the digital twin is developed, including data, analytics, visualization, and integration modules that enable the implementation of the proposed formalization. Examples of model specification for CII objects of various significance categories are given. The proposed formalization provides a theoretical foundation for building adaptive security systems operating in a dynamically changing cyber threat landscape.
E.S. Mityakov· Informatization and communic...· 0 citations
Objective
. To enhance the actual security of automated police systems, it is necessary to identify, systematize, and comprehensively analyze typical phishing-related information security threats aimed at compromising the components of these systems and misleading operators and users.
Method
. The solution method is a comprehensive analysis of typical information security threats in automated police systems, implemented using fake websites through phishing attacks.
Result
. Based on an analysis of the information security threat database developed by the Federal Service for Technical and Export Control of Russia, as well as the operational characteristics of modern automated police systems, information on the nature of phishing attacks and their technical characteristics, and the results of a survey of information security specialists in departmental automated police systems, typical information security threats implemented through phishing attacks were identified. An analysis of the identified information security threats was conducted, taking into account their sources, targets, exploited vulnerabilities of automated police system components, and the potential consequences of their implementation.
Conclusion
. The results are planned to be used in further research for a quantitative assessment of the risks of implementing information security threats using fake websites, taking into account the time factor and the extent of information damage, in order to identify priority scenarios for their implementation and justify the choice of information security measures in the AS OVD.
I. Drovnikova, T.Yu. Tuzhikova· Herald of Dagestan State Tec...· 0 citations
The article is devoted to the development of a secure DevSecOps framework for cloud infrastructure protection. The purpose of the study is to substantiate the author's approach to building such a framework based on the integration of artificial intelligence-based cyber threat detection technologies and data leakage prevention mechanisms. The scientific research used general scientific methods of cognition, in particular analysis, synthesis, generalization, systematization and classification, as well as the Relative Importance Index to assess the priority of the author's development components. The results of the study show that cloud infrastructure protection covers at least six levels of architecture, each of which requires a separate set of control mechanisms, and the classes and models of cloud services form a different distribution of responsibility between the provider and the consumer. Modern security technologies are systematized, covering secure service networks, data categorization in transit, continuous integration pipeline certification, and AI-based vulnerability detection tools. Based on the analysis, a proprietary secure DevSecOps framework is proposed that combines behavioral anomaly assessment, automated SIEM event correlation, built-in secure development controls, project-based data leakage prevention, and cloud infrastructure hardening. An assessment of the framework components by the relative importance index showed that automated SIEM event correlation and behavioral anomaly assessment have the highest priority, while secure development controls, data leakage prevention, and infrastructure hardening play a supporting but necessary role. The practical significance of the research lies in the possibility of using the proposed framework by organizations implementing cloud services to build a holistic system for detecting and preventing cyber threats at all stages of the software development life cycle.
Kateryna Oblakevych· Global Prosperity· 0 citations
Academic information systems manage sensitive data whose integrity directly affects academic administration and student outcomes. Legacy intranet-based systems may remain vulnerable to both technical attacks and human-factor threats, particularly when outdated software, unencrypted communication, weak access controls, and privileged user access coexist within the same operational environment. Objective: This study aims to analyze the security vulnerabilities of the Informatics Engineering Laboratory Information System (SILABTI) and identify potential pathways for unauthorized modification of practicum grades and graduation statuses using a hierarchical Attack Tree approach. Methodology: This study employed an analytical systems-engineering design based on Attack Tree threat modeling. The assessment covered the SILABTI web application, local network environment, MySQL database architecture, and administrative workflows. System boundaries and technical conditions were identified through infrastructure assessment and network reconnaissance, followed by hierarchical decomposition of adversarial objectives into root goals, intermediate sub-goals, and technical execution leaf nodes using AND/OR relationships. The resulting attack pathways were qualitatively evaluated according to technical prerequisites, execution complexity, system exposure, and detection probability. Findings: The analysis identified four primary intrusion vectors: credential acquisition, application exploitation, database exploitation, and insider exploitation. Four pathways were considered particularly high-risk: local network sniffing, workstation keylogging, automated brute-force attacks, and insider bribery or coercion. These findings indicate that SILABTI's security risks arise from the interaction of legacy software, network communication weaknesses, endpoint privileges, authentication controls, and human factors. Implications: The findings support an eight-point defense-in-depth framework incorporating TLS/HTTPS, tamper-resistant audit logging, role-based access control, network access restrictions, stronger authentication controls, workstation privilege restriction, anti-spoofing measures, and institutional security governance. This framework can guide university IT administrators in strengthening legacy academic information systems. Originality: This study contributes a hierarchical threat-decomposition model specifically designed for a legacy intranet-based academic laboratory information system, integrating technical and human-layer attack pathways within a single security assessment framework.
Puji Zulaikasari, Avinanta Tarigan· International Journal for Sc...· 0 citations