Fluent Essays

15 full pages due kesho 11pm Please take your time, follow all the instructions to the latter and do a great job for the student because he/she is very strict with the instruction Also make sure you proofread the work for proper grammar and sentence structure You write scientific papers about My Topic (cybersecurity and IoT) You have to follow each single daitlas for these 3 website to write this paper You have to follow these website to write this paper: 1-http://www.columbia.edu/cu/biology/ug/research/pap... 2-http://www.columbia.edu/cu/biology/ug/research/pap... 3-This link is so important to get guid line syle and Our online submission system guides you stepwise through the process of entering your article details https://www.elsevier.com/journalsa/international-j... You have to follow 11 steps to write this scientific paper 1-Prepare the figures and tables. 2-Write the Methods. 3-Write up the Results. 4-Write the Discussion. Finalize the Results and Discussion before writing the introduction. This is because, if the discussion is insufficient, how can you objectively demonstrate the scientific significance of your work in the introduction? 5-Write a clear Conclusion. 6-Write a compelling introduction. 7-Write the Abstract. 8-Compose a concise and descriptive Title. 9-Select Keywords for indexing. 10Write the Acknowledgements. 11-Write up the References. This website for journal to follow how to write this paper that is important for me. https://www.elsevier.com/journals/international-jo... These website How will the content be the paper what and how will you write ? 1-http://www.columbia.edu/cu/biology/ug/research/pap... 2-http://www.columbia.edu/cu/biology/ug/research/pap... The topic is cyberheist and IoT My research question is: (what effect does use OTP and fingerprinter to protect account organizations to downloads date?) The problem is a hacker to access an account for an organization My solution use (One-time password)OTP and fingerprinter to access the account of the organization every single time in use Attachments area Computer Science and Information Technology EFFECTIVENESS OF ONE-TIME-PASSWORD AND FINGERPRINT USE TO PROTECT AN ORGANIZATION’S ACCOUNT FROM CYBER-SECURITY THREATS Author Abstract Cyber-security is referred to as the activity and process that entails the protection of information systems and data contained from malicious attackers. Hackers are ever on great demand of the data belonging to various organizations regardless of the geographical distance in between. This paper proposes the adoption of a cyber-security model that involves the utilization of OTP and fingerprint to keep hackers. This is a decision informed by the current study findings which attempted to analyze the major areas of cyber-security concern in an organization. The highlighted threats are aided by two broad mechanisms, which include poor user account management practices and external-based mechanisms. Keywords: cyber-heist, Cyberspace, One-Time-Password, Buy-Your-Own-Device 1.0 Introduction Globally, entities/ organizations, as well as economies, have embarked on finding ways to mitigate losses caused by data theft or illegal sharing of files that take place in organization’s IoT accounts as well as information systems which is often perpetrated by disgruntled employees, malicious attackers or intruders. These actions take time to plan but can be executed quickly and involve losses of large sums of money usually described as cyber-heist. According to [1], insecurity in the cyberspace is a worrying trend, 72 percent of the major sampled multinationals consider it as second most concerning factor. Further, [2] claims that over 80 percent of the cyber insecurity incidences experienced by organizations are internally perpetrated crimes. It is agreeable that sealing internal loopholes is way difficult than dealing with external ones. Furthermore, the majority of these organizations have stuck to the traditional methods of handling cyber-security challenges such as the use of firewalls for network intrusion detection and prevention, anti-virus software to deal with worms and virus injections, event and security information management among others. The effectiveness of these methods has been questioned because of the increasing number of cyber insecurity incidents as well as the extent to which the attacks have metamorphosed in terms of sophistication and ferocity, especially the ones perpetuated by online-based gangs. Sadly, it takes approximately three months and above for vigilant companies to realize they have been attacked unless the type of attack is outward and aggressive, like denial of service (DDoS) [3]. In some cases, organizations may take as long as seven months before realizing compromises within the ranks of their systems, especially if the kind of attack leveled is less aggressive when it comes to day to day service delivery. Such can be data theft or unauthorized gradual data modification. In a worst-case scenario, it can take more than a year for an organization to realize an attack, and in such cases, the magnitude of the loss is often unfathomable. Industry-wise, the cyber threats attributed losses are somewhere in the region of $125 billion annually and in excess of $300 billion if downtimes are also put into consideration, as indicated by [4]. As a consequence, the knowledge of threat surface composition enhances the understandability of the extent of the challenge at hand. Thomas et al. [5] classifies the cyberspace threats into four major layers upon which manifestation of severity is apparent. Fig. 1 below depicts their perspective regarding how the issues should be attended to. HIGH-LEVEL PERSISTENT THREATS ORGANIZED CRIME RANSOM CRIMINALS SCRIPT KIDDIES LAYER 1 LAYER 2 LAYER 3 LAYER 4 Figure 1: Cyberspace Threats Classification From fig. 1 above, High-level Persistent Threats (HPT) tops the threat list. The HPTs are considered to be the most lethal because they are conducted on a large scale and often come from adversary countries. However, they mostly target organizations offering critical infrastructure, which also includes government agencies. The second layer comprises organized crime threats, which also include cyber-heist and related crimes. The above classification provides organizations with the opportunity to comprehend all manner of threats and thereby take note of the ones relevant to their platforms. In this case, we look at the strategies the organizations use to deal with organized crime amounting to cyber-heist. Entities have been formidable in their response to these challenges. For instance, the industry has come with new user authentication strategies, which are seen to be the optimal way of addressing internally organized cyber-heists. These threats mostly target corporates and government agencies. Ransom criminals represent a group of online extortionists. In the last layer are the script kiddies. These are online codes scavenging for potential weak-lines to attack. The two-factor authentication (2FA), which involves the use of one-time-password (OTP) and biometrics, specifically the fingerprint, has been identified as an effective strategy to deal with the menace. The 2FA has since been christened as dual-factor authentication or two-step verification. It is a security process that prompts system users to issue two unrelated factors of authentication as a means of verifying themselves. The process has been found to be a better option when it comes to the protection of both the regular system users’ credentials as well as the resources available in the system that users utilize on a case by case basis. The process certainly guarantees a higher level of security compared to the previous methods of authentication that utilize single-factor authentication (SFA), where the user is only required to provide one factor – for instance, a passcode or a password. The emerging method of authentication will always require a user to provide a one-time-password, which is the first factor, then go ahead to demand for a second factor of authentication, often either a biometric factor like the fingerprint scanner or a security token which is not quite popular as per now. By adding an additional security layer to the process of authentication, the two-factor authentication process makes it harder for malicious attackers, whether external or internal, to acquire access to the organization's system as well as the Internet of Things (IoT) devices, as well as various online accounts. The effectiveness of the process is tested when perpetrators of such malicious acts are unable to crack one-time-password. If by chance, they manage, that alone cannot guarantee them a successful pass of the authentication check. The 2FA is gaining wide use in controlling access to data and sensitive systems, together with providers of online services who prioritize protecting the credentials of their clients from abuse by hackers. The main contributions of this paper are the proposed use of a one-time-password and fingerprint scanner to protect an organization’s account from cyber-heist and IoT insecurities. The model attempts to piece up all important elements with significant contributions towards safer cyberspace among organizations. The model also emphasizes the significance of cooperation among major players in the industry in order to create an environment of reduced incidences of cyber insecurity. Overreliance on the traditional methods of handling cyber-security challenges such as the use of firewalls for network intrusion detection and prevention, anti-virus software to deal with worms and virus injections, event, and security information management among others have delayed wide adoption of new effective strategies such as the 2FA. The proposed approach guarantees a state of a security assessment model that is integrated, proactive, and extendable. Other remaining parts of the paper depict the following organization; section two of the paper comprising a discussion of the related work pertaining to cyber-security generalities. In section three, we discuss the approach, while in section four, we detail the proposed cyber-security framework model. Finally, we put forward conclusions and a framework going into the future. 2.0 Methods Systems strive to guarantee four major elements; Integrity, Availability, Confidentiality, and Authenticity (IACA). Occasionally, organizational system accounts still suffer from cases of unauthorized access, among other types of cyber-security challenges. In an attempt to ensure consistency with IACA provision and consequently eliminate or significantly reduce cases of unauthorized access, there will be a great need to inject awareness which will be premised on the intervention of factors like the operational, technical as well as industry-level cooperation. Mendel Jacob [6] issues an insightful explanation of what is meant by the term “organizational account” which he defines as “a user email or application account fully resident on the organization’s administrative means.” To qualify the above assertion, it is important to first consider how and when an organization can create a user account. Organizations can create an account after they have grown to a level they can own a Service Directory, which they use to synchronize their cloud platforms. Tweneboah-Koduah [7] defines a Service Directory as a single place where publishing, discovering, and connecting services in a reliable, seamless, and consistent manner devoid of characteristics and influences of their environment. Service Directory provides support to cloud-based service providers such as Google Cloud, Microsoft Azure (Active Directory) multi-cloud, as well as others like the on-premises environments and has the scalability of up to thousands of endpoints and services for a single project. According to [8], synchronization between an organization's cloud identity and an active service directory provides necessary usability characteristics such as a holistic view to ending users, among others. An organizational account, therefore, can be defined as an account created by the organization's system administrator to enable users to access services residents in the cloud platform. For example, a company utilizing cloud services offered by Microsoft Azure, Office 365, or Amazon Web Services (AWS) while creating an account will take the form of a user's organizational email address. Users, in this case, can be employees of the organization or clients and can as well be remotely located. Mackey et al. [9] postulate that many corporate organizational user accounts face authorization challenges as a result of bad practices in relation to the general use – and abuse – of privileged accounts. The discussion further outlines that these companies are fond of applying ‘copy-pasted’ unrealistic policies that are often bypassed or abused by users without repercussions. Alternatively, some exist without policies in place to guide users, thus little or no control. Typically, organizational user accounts permit administrative rights, often referred to as a superuser. The discussion indicates that these superuser accounts attribute to 38 percent of loopholes that aided cyber-heist in among multinationals sampled. In general, there should never be situations where some accounts are subjected to strict policies while others are allowed to operate in less restrictive policies under the disguise of being senior compared to other low ranking ones. All system users should be subjected to similar policies; hence the accounts just as well exist in identical access privileges. Cohen et al. [10] reiterate that IT staff in many companies are frequently involved in creating user accounts using administrative rights. This is often the case in organizations that use UNIX systems. The approach presents several problems since the legitimate account user will often find it normal to use their actual user account for general access. Later on, it further creates more security challenges for the IT Security Team while undertaking to audit and is faced with a hard time as they attempt to decipher the kind of log-ins utilized during the time of conducting administrative tasks as well as the log-ins for general access. It is observed that such practices are capable of introducing Trojan horse attacks into the system, especially in environments such as the Windows. Thomas et al. [11] suggest solutions to these problems created out of bad practices such as allocating administrative rights to several accounts as well as establishing shared accounts UNIX and Windows environments as limiting the number of privileged accounts as well as keeping passwords of such accounts in secure locations. The suggestion continues that passwords to the shared accounts should also be changed regularly and be availed on a ‘need to have’ basis. Also, there is a need to capture the management of the shared accounts’ passwords as well as the administrative and account service/root passwords in a comprehensive IT security policy. This, among other benefits, will also enhance tracking of audit trails of password access attempts. As a final solution to the above security challenges, designating each shared account to a legitimate owner who will take responsibility for account activities, including controlling access. It is believed that such arrangements enhance chances for a contingency procedure where any group member can be legitimized to release a password. As much as organizational user account security challenges and inefficiencies are blamed on poor user account management practices, [12] indicates that 50 percent of organizational user account cyber-security challenges originate from external sources. With the employees in need of access to an ever-expanding list of applications, both in-house and IoT-based systems, and other numerous IT assets, the threat level has almost tripled. The new phenomenon, IoT, has aggravated cyber-security issues due to the need to connect to all manner of applications and devices with the ability to connect to the internet. Further, policies and practices such as the 'Bring Your Own Device' (BYOD), which encourages the use of private devices like the laptop to access the organization's user accounts and carry out tasks has compounded the problem. Emails, printers, files, databases, as well as web applications all require proper security measures since attackers can exploit any of them and use them as an attack vector into the organization's information infrastructure. What used to be regarded as lone attackers have metamorphosed into sophisticated entities, some of which operate as as-a-service-type of automated attacking tools and possess extremely high replication ability across the Internet. If a group of attackers intends to launch an attack on an organization, the process has increasingly been made easy in that the group will only be a few clicks away from executing the intention. Trotter et al. [13] expose the inadequacies of the suggested solutions to bridge gaps created by poor user account management practices. A quick reminder to these solutions includes limiting the number of privileged accounts, keeping passwords of such accounts in secure locations, frequent change of passwords for the shared accounts, and only availing them on a ‘need to have’ basis. Also suggested is the need to develop an IT security policy to capture the management of the shared accounts' passwords as well as the administrative and account service/root passwords. The argument advanced by this author relegates the poor user account management practices suggested solutions relevant to the level of peer-to-peer traditional organizational architecture where communication between devices is under control of the server. There is a total lack of mechanisms of how to handle challenges from the adoption of BYOD policies, as well as the IoT and sophisticated nature of the modern-day attackers. Consequently, [14] critiques the effectiveness of traditional cyber-security defense mechanisms that the majority of organizations still rely on. For some time now, the use of a firewall for detecting and preventing network intrusion remains a top priority for many organizations. Hackers have developed several ways of bypassing firewalls, including backdoor strategies, taking advantage of vulnerable websites; exploit BYOD devices after the employees have left working premises, among others. Similarly, the use of anti-virus software to deal with worms and virus injections is still in use despite the availability of overwhelming evidence indicating how the strategy has become less effective. According to [15], China alone generated 82, 000 malicious worms in a single month. However, updated antivirus can be the rate at which malware is generated and fed into cyberspace is unmatchable. Event and security information management has also been a reliable means of protecting organizational information technology infrastructure against external attacks. Although still effective, its applicability is limited to the simple network system topologies. In other words, its use is widely hindered by veracity exhibited by modern technologies like the IoT that virtually connects all devices with the ability to access the internet. Generally, the effectiveness of these methods has been questioned because of the increasing number of cyber insecurity incidents as well as the extent to which the attacks have metamorphosed in terms of sophistication and ferocity, especially the ones perpetuated by online-based gangs. Sadly, it takes approximately three months and above for vigilant companies to realize they have been attacked unless the type of attack is outward and aggressive, like denial of service (DDoS). In some cases, organizations may take as long as seven months before realizing compromises within the ranks of their systems, especially if the kind of attack leveled is less aggressive when it comes to day to day service delivery. Such can be data theft or unauthorized gradual data modification. Gheyas & Abdallah [15] delves into the issue of cyber-security and IoT with a focus on the 2FA, which involves the use of OTP and biometrics, specifically the fingerprint that has been identified as an effective strategy to deal with the menace. The model is a two-step verification security process that prompts system users to issue two unrelated factors of authentication as a means of verifying themselves. The process has been found to be a better option when it comes to the protection of both the regular system users' credentials as well as the resources available in the system that users utilize on a case by case basis. The process certainly guarantees a higher level of security compared to the previous methods of authentication that utilize single-factor authentication (SFA), where the user is only required to provide one factor – for instance, a passcode or a password. The 2FA is a two-tier authentication process that first requires a user to provide a one-time-password as the first factor, then the second factor of authentication often either a biometric factor like a fingerprint or a security token which is not quite popular with users. The extra security layer present in 2FAs is actually the game-changer. In the IoT platform, there is high-level interconnectivity of devices. There is a great chance that malicious attackers in the IoT platform find it easy to develop digital footprints of the connected devices, especially the ones with vulnerability issues. The effectiveness of the process is tested when perpetrators of such malicious acts are unable to crack one-time-password. If by chance, they manage, that alone cannot guarantee them a successful pass of the authentication check. The 2FA is gaining wide use in controlling access to data and sensitive systems, together with providers of online services who prioritize protecting the credentials of their clients from abuse by hackers. Fayans [16] provides an insightful discussion of how 2FA authentication schemes utilize biometrics. The use of biometrics stands out as one of the competing technologies as far as the implementation of 2FA is concerned. The difference here is that biometrics utilizes 'what you are’ to authenticate instead of ‘what you have’ mechanism that traditional authentication methods rely on. Several studies encouraged the use of biometrics in conducting authentications. The use of biometrics in authentication has evolved over time. Sleeman et al. [17] proposed the use of smartcard remote-based user authentication. This scheme relied on the nonce and simplified hash functions to enhance efficiency. The use of the random nonce over synchronized clock made the proposed scheme cost-effective. However, the scheme presented some weaknesses, especially in preventing the man in the middle attacks. The proposal was later improved by [18] input, which attempted to resolve the weakness earlier shown towards the man in the middle attacks by including session key agreements. It used a password alongside random nonce to perform authentication in both phases of user login. However, the scheme, too, failed to carry out user verification hence needed further improvements. Every finger has its own unique fingerprints, including those of identical twins. Fingerprint-based biometrics currently enjoys wide use, especially in controlling physical access to restricted premises. As the most widespread biometric technology, devices used for fingerprint recognition PC access are increasingly becoming available at affordable costs. The presence of these devices has caused the relegation of the password used in several platforms. A combination of fingerprint and an OTP code provides a high-level user authentication scheme that can secure organizational user accounts from a wide range of compromises. 3.0 Results The proposed solutions aimed at addressing poor user account management practices are deemed inadequate. These solutions include limiting the number of privileged accounts, keeping passwords of privileged accounts in secure locations, frequent change of passwords for the shared accounts, and only availing them on a ‘need to have’ basis. The proposed solutions lack the capacity to address sophisticated threats such as DDoS, ransomware, phishing, among others that are often encountered by the organization's information technology infrastructure. On the other hand, traditional cyber-security defense strategies such as the use of a firewall for detecting and preventing network intrusion and using anti-virus software to prevent malware from attacking the system. They, too, are deemed less effective as far as cyber-security defense is concerned. OTP password and fingerprint authentication are considered effective. 4.0 Discussion In [8], and an organizational account is defined as an account created by an organization's system administrator to enable users to access services resident in the cloud platform. The account, therefore, is part of the organization's information infrastructure that deserves utmost security. In [9][10][11][12][13], the authors outline various cyber-security threats that organizational user accounts face. The highlighted threats are aided by two broad mechanisms, which include poor user account management practices and external-based mechanisms. Considering the internal threat aiding mechanisms, it is postulated that many corporate organizational user accounts face authorization challenges as a result of bad practices in relation to the general use – and abuse – of privileged accounts. Still, on the internal attack vectors, the discussion indicates that the superuser accounts attribute to 38 percent of loopholes that aided cyber-heist among multinationals sampled. The solutions proposed include limiting the number of privileged accounts, keeping passwords of such accounts in secure locations, frequent change of passwords for the shared accounts, and only availing them on a ‘need to have’ basis. Also suggested is the need to develop an IT security policy to capture the management of the shared accounts' passwords as well as the administrative and account service/root passwords. The proposed solutions lack the capacity to address sophisticated threats such as DDoS, ransomware, phishing, among others, that are often encountered by the organization’s information technology infrastructure. As initially indicated, 50 percent of organizational user account cyber-security challenges originate from external sources. Employees actively utilize applications both in-house and IoT-based, further exposing them to phishing, ransomware, DDoS, hacking, among others. Also, policies and practices such as the 'Bring Your Own Device' (BYOD), which encourages the use of private devices like the laptop to access the organization's user accounts and carry out tasks has compounded the problem. Emails, printers, files, databases, as well as web applications all require proper security measures since attackers can exploit any of them and use them as an attack vector into the organization's information infrastructure. Subsequently, there is strong evidence that the widely used traditional cyber-security defense mechanisms have become less effective. If the hackers can maintain their current pace of carrying out their work, then the industry will soon be overwhelmed by hacking incidences. As earlier indicated, hackers have developed several ways of bypassing firewalls, including backdoor strategies, taking advantage of vulnerable websites; exploit BYOD devices after the employees have left working premises, among others. Fig. 2 below depicts the trend of data representing the successful rate of firewall bypass. Figure 2: Data Trends Showing the Rate of Firewall bypass by Hackers over the years The fig.2 above shows the hacker's success rate on bypassing various organization firewalls between 2011 and 2019. The graph shows a steady rise in the part of hackers. Also, the use of anti-virus software to deal with worms and virus injections is still in use despite the availability of overwhelming evidence indicating how the strategy has become less effective. In [17], the author issued various perspectives concerning the application of biometrics in the authentication. As noted earlier, biometrics utilizes truth and nothing more. With the online organizational environment becoming busier and riskier, the need to engage new cybersecurity strategies becomes a necessity. Hackers' sophistication equally continues to grow amidst various developments and milestones that the industry is registering. There are several types of biometrics that are equally for authentication. There are those that use smartcards; others use face, fingerprints, among others. A combination of fingerprint and an OTP code provides a high-level user authentication scheme that can secure organizational user accounts from a wide range of compromises. Fig. 2 below depicts the author's perspective regarding the conceptual framework of 2FA. Primary Authentication Figure 3: Two Factor Authorization USERNAME PASSWORD Fingerprint for Sec Auth. Cloud service OTP Two-factor clearance The fig. 3 above is a depiction of how the 2FA functions. As earlier indicated, the major difference is that biometrics utilizes ‘what you are’ to authenticate instead of ‘what you have’ mechanism that traditional authentication methods rely on. The game-changer, as far as the use of OTP and fingerprint, is actually the implementation of two-factor authentication to issues users’ identity based on the premise that an unauthorized actor is unlikely to be able to supply both factors required for access. For instance, if a hacker or just a normal person launches an illegal authentication attempt, at least one of the components is missing or incorrect, the user’s identity is not established with sufficient certainty, and access to the user's organizational user account is protected by two-factor authentication remains blocked. Conclusion Cyberspace resembles a battlefield where intelligence is intensively sought for strategic positioning, vindication, distinguishing, and elimination of threats for the seamless running of an organization's critical system. This paper proposes the adoption of a cyber-security model that involves the utilization of OTP and fingerprint to keep hackers. This is a decision informed by the current study findings which attempted to analyze the major areas of cyber-security concern in an organization. The highlighted threats are aided by two broad mechanisms, which include poor user account management practices and external-based mechanisms. The solutions proposed include limiting the number of privileged accounts, keeping passwords of such accounts in secure locations, frequent change of passwords for the shared accounts, and only availing them on a 'need to have' basis. On the other hand, there are cyber-security challenges that originate from external sources. The implication of the study is that it can play a role in influencing cyberspace security policy direction. The model evaluation was mainly based on expert views. On the other hand, the study is expected to expand horizons, especially for oncoming cyber-security. From the study, it is discernible that the situation of cyber-security still needs attention. References [1] Lamba, Anil, Satinderjeet Singh, Singh Balvinder, Natasha Dutta, and Sivakumar Rela."Mitigating Cyber Security Threats of Industrial Control Systems (Scada & Dcs)." In 3rd International Conference on Emerging Technologies in Engineering, Biomedical, Medical, and Science (ETEBMS–July 2017). 2017. [2] M. Kumar, "The Hacker News," 22 April 2016. [Online]. Available: http://thehackernews.com/.[Accessed 22 April 2016] [3] L. Christian, S. David B., and T. Victoria E., "Beyond the Castle Model of Cyber-risk and cybersecurity, "Elservier Inc,2016 [4] Thomas, Bernard, David Scott, Fred Brott, and Paul Smith. "Dynamic adaptive defense for cyber-security threats." U.S. Patent 10,129,290, issued November 13, 2018. [5] Thomas, Bernard, David Scott, Fred Brott, and Paul Smith. "Dynamic adaptive defense for cyber-security threats." U.S. Patent 10,616,265, issued April 7, 2020. [6] Mendel, Jacob. "Smart grid cybersecurity challenges: Overview and classification." e-mentor 68, no. 1 (2017): 55-66. [7] Tweneboah-Koduah, Samuel, Knud Erik Skouby, and Reza Tadayoni. "Cybersecurity threats to IoT applications and service domains." Wireless Personal Communications 95, no. 1 (2017): 169-185. [8] Narayanan, Sandeep Nair, Ashwinkumar Ganesan, Karuna Joshi, Tim Oates, Anupam Joshi, and Tim Finin. "Early detection of cybersecurity threats using collaborative cognition." In 2018 IEEE 4th international conference on collaboration and internet computing (CIC), pp. 354-363. IEEE, 2018. [9] Mackey, Tim K., and Gaurvika Nayyar. "Digital danger: a review of the global public health, patient safety, and cybersecurity threats posed by illicit online pharmacies." British medical bulletin 118, no. 1 (2016): 110-126. [10] Cohen, Alon, Amos Stern, and Garry Fatakhov. "System and method for contextually analyzing potential cybersecurity threats." U.S. Patent 10,262,133, issued April 16, 2019. [11] Thomas, Bernard, David Scott, Fred Brott, and Paul Smith. "Dynamic adaptive defense for cyber-security threats." U.S. Patent 10,505,972, issued December 10, 2019. [12] Coventry, Lynne, and Dawn Branley. "Cybersecurity in healthcare: a narrative review of trends, threats, and ways forward." Maturitas 113 (2018): 48-52. [13] Trotter, Ludwig, Mike Harding, Mateusz Mikusz, and Nigel Davies. "IoT-Enabled Highway Maintenance: Understanding Emerging Cybersecurity Threats." IEEE Pervasive Computing 17, no. 3 (2018): 23-34. [14] Puthal, Deepak, Saraju P. Mohanty, Priyadarsi Nanda, and Uma Choppali. "Building security perimeters to protect network systems against cyber threats [future directions]." IEEE Consumer Electronics Magazine 6, no. 4 (2017): 24-27. [15] Gheyas, Iffat A., and Ali E. Abdallah. "Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis." Big Data Analytics 1, no. 1 (2016): 6. [16] Fayans, Iliya, Yair Motro, Lior Rokach, Yossi Oren, and Jacob Moran-Gilad. "Cyber security threats in the microbial genomics era: implications for public health." Eurosurveillance 25, no. 6 (2020): 1900574. [17] Sleeman, Jennifer, Tim Finin, and Milton Halem. "Temporal Understanding of Cybersecurity Threats." In IEEE International Conference on Big Data Security on Cloud. 2020. [18] Lawson, Sean, and Michael K. Middleton. "Cyber Pearl Harbor: Analogy, fear, and the framing of cyber security threats in the United States, 1991-2016." First Monday (2019). Successful Rate Firewall Bypass 2011 2012 2013 2014 2015 2016 2017 2018 2019 0.12 0.16 0.18 0.25 0.26 0.32 0.3 6 0.36 0.42 1 Computer Science and Information Technology 1 EFFECTIVENESS OF ONE - T IME - PASSWORD AND FINGERPRINT USE TO PROTECT AN ORGANIZATION ’S ACCOUNT FROM CYBER - SECURITY THREATS Author Abstract Cyber - security is referred to as the activity and process that entails the protection of information systems and data contained from malicious attackers. Hackers are ever on great demand of the data belonging to various organizations regardless of the geog raphical distance in between. This paper proposes the adoption of a cyber - security model that involves the utilization of OTP and fingerprint to keep hackers. This is a decision informed by the current study findings which attempted to analyze the major areas of cyber - securi ty concern in an organization. The highlighted threats are aided by two broad mechanisms, which include poor user account management practices and external - based mechanisms. Keywords : cyber - heist, Cyberspace, One - Time - Password, Buy - Your - Own - Device 1.0 Introduction Globally, entities/ organizations, as well as economies, have embarked on finding ways to mitigate losses caused by data theft or illegal sharing of file s that take place in organization’s IoT accounts as well as informatio n systems which is often perpetrated by disgruntled employees, malicious attackers or intruders. These actions take time to plan but can be executed quickly and involve losses of large sums of money usually described as cyber - heist. According to [1], inse curity in the cyberspace is a worrying trend, 72 percent of the major sampled multinationals consider it as second most concerning factor. Further, [2] claims that over 80 Computer Science and Information Technology 1 EFFECTIVENESS OF ONE-TIME-PASSWORD AND FINGERPRINT USE TO PROTECT AN ORGANIZATION’S ACCOUNT FROM CYBER-SECURITY THREATS Author Abstract Cyber-security is referred to as the activity and process that entails the protection of information systems and data contained from malicious attackers. Hackers are ever on great demand of the data belonging to various organizations regardless of the geographical distance in between. This paper proposes the adoption of a cyber-security model that involves the utilization of OTP and fingerprint to keep hackers. This is a decision informed by the current study findings which attempted to analyze the major areas of cyber-security concern in an organization. The highlighted threats are aided by two broad mechanisms, which include poor user account management practices and external-based mechanisms. Keywords: cyber-heist, Cyberspace, One-Time-Password, Buy-Your-Own-Device 1.0 Introduction Globally, entities/ organizations, as well as economies, have embarked on finding ways to mitigate losses caused by data theft or illegal sharing of files that take place in organization’s IoT accounts as well as information systems which is often perpetrated by disgruntled employees, malicious attackers or intruders. These actions take time to plan but can be executed quickly and involve losses of large sums of money usually described as cyber-heist. According to [1], insecurity in the cyberspace is a worrying trend, 72 percent of the major sampled multinationals consider it as second most concerning factor. Further, [2] claims that over 80 So important these rules because these are for the journal so you have to follow each single rule here All necessary files have been uploaded: Manuscript: • Include keywords • All figures (include relevant captions) • All tables (including titles, description, footnotes) • Ensure all figure and table citations in the text match the files provided • Indicate clearly if color should be used for any figures in print Graphical Abstracts / Highlights files (where applicable) Supplemental files (where applicable) Use of inclusive language Inclusive language acknowledges diversity, conveys respect to all people, is sensitive to differences, and promotes equal opportunities. Articles should make no assumptions about the beliefs or commitments of any reader, should contain nothing which might imply that one individual is superior to another on the grounds of race, sex, culture or any other characteristic, and should use inclusive language throughout. Authors should ensure that writing is free from bias, for instance by using 'he or she', 'his/her' instead of 'he' or 'his', and by making use of job titles that are free of stereotyping (e.g. 'chairperson' instead of 'chairman' and 'flight attendant' instead of 'stewardess'). Author contributions For transparency, we encourage authors to submit an author statement file outlining their individual contributions to the paper using the relevant CRediT roles: Conceptualization; Data curation; Formal analysis; Funding acquisition; Investigation; Methodology; Project administration; Resources; Software; Supervision; Validation; Visualization; Roles/Writing - original draft; Writing - review & editing. Authorship statements should be formatted with the names of authors first and CRediT role(s) following.  Language (usage and editing services) Please write your text in good English (American or British usage is accepted, but not a mixture of these). Authors who feel their English language manuscript may require editing to eliminate possible grammatical or spelling errors and to conform to correct scientific English may wish to use the English Language Editing service available from Elsevier's Author Services. Submission Our online submission system guides you stepwise through the process of entering your article details and uploading your files. The system converts your article files to a single PDF file used in the peer-review process. Editable files (e.g., Word, LaTeX) are required to typeset your article for final publication. All correspondence, including notification of the Editor's decision and requests for revision, is sent by e-mail. IMPORTANT NOTE: In case you submit a special issue paper that will be handled by a designated Special Issue Guest Editor, please follow the instructions below: 1. Author registers in EES (follow the instructions on the site) 2. Select: Submit Manuscript from Main Menu 3. When choosing Article Type please select the title of the special issue to which you are submitting Use of word processing software It is important that the file be saved in the native format of the word processor used. The text should be in single-column format. Keep the layout of the text as simple as possible. Most formatting codes will be removed and replaced on processing the article. In particular, do not use the word processor's options to justify text or to hyphenate words. However, do use bold face, italics, subscripts, superscripts etc. When preparing tables, if you are using a table grid, use only one grid for each individual table and not a grid for each row. If no grid is used, use tabs, not spaces, to align columns. The electronic text should be prepared in a way very similar to that of conventional manuscripts (see also the Guide to Publishing with Elsevier). Note that source files of figures, tables and text graphics will be required whether or not you embed your figures in the text. See also the section on Electronic artwork. To avoid unnecessary errors you are strongly advised to use the 'spell-check' and 'grammar-check' functions of your word processor. LaTeX You are recommended to use the Elsevier article class elsarticle.cls to prepare your manuscript and BibTeX to generate your bibliography. Our LaTeX site has detailed submission instructions, templates and other information. Article structure Subdivision - numbered sections Divide your article into clearly defined and numbered sections. Subsections should be numbered 1.1 (then 1.1.1, 1.1.2, ...), 1.2, etc. (the abstract is not included in section numbering). Use this numbering also for internal cross-referencing: do not just refer to 'the text'. Any subsection may be given a brief heading. Each heading should appear on its own separate line. Appendices If there is more than one appendix, they should be identified as A, B, etc. Formulae and equations in appendices should be given separate numbering: Eq. (A.1), Eq. (A.2), etc.; in a subsequent appendix, Eq. (B.1) and so on. Similarly for tables and figures: Table A.1; Fig. A.1, etc. Vitae Submit a short (maximum 100 words) biography of each author, along with a passport-type photograph accompanying the other figures. Please provide the biography in an editable format (e.g. Word), not in PDF format. Essential title page information • Title. Concise and informative. Titles are often used in information-retrieval systems. Avoid abbreviations and formulae where possible. • Author names and affiliations. Please clearly indicate the given name(s) and family name(s) of each author and check that all names are accurately spelled. You can add your name between parentheses in your own script behind the English transliteration. Present the authors' affiliation addresses (where the actual work was done) below the names. Indicate all affiliations with a lower-case superscript letter immediately after the author's name and in front of the appropriate address. Provide the full postal address of each affiliation, including the country name and, if available, the e-mail address of each author. • Corresponding author. Clearly indicate who will handle correspondence at all stages of refereeing and publication, also post-publication. This responsibility includes answering any future queries about Methodology and Materials. Ensure that the e-mail address is given and that contact details are kept up to date by the corresponding author. • Present/permanent address. If an author has moved since the work described in the article was done, or was visiting at the time, a 'Present address' (or 'Permanent address') may be indicated as a footnote to that author's name. The address at which the author actually did the work must be retained as the main, affiliation address. Superscript Arabic numerals are used for such footnotes. Highlights Highlights are mandatory for this journal as they help increase the discoverability of your article via search engines. They consist of a short collection of bullet points that capture the novel results of your research as well as new methods that were used during the study (if any). Please have a look at the examples here: example Highlights. Highlights should be submitted in a separate editable file in the online submission system. Please use 'Highlights' in the file name and include 3 to 5 bullet points (maximum 85 characters, including spaces, per bullet point). Abstract A concise and factual abstract is required. The abstract should state briefly the purpose of the research, the principal results and major conclusions. An abstract is often presented separately from the article, so it must be able to stand alone. For this reason, References should be avoided, but if essential, then cite the author(s) and year(s). Also, non-standard or uncommon abbreviations should be avoided, but if essential they must be defined at their first mention in the abstract itself. Keywords Immediately after the abstract, provide a maximum of 6 keywords, using American spelling and avoiding general and plural terms and multiple concepts (avoid, for example, 'and', 'of'). Be sparing with abbreviations: only abbreviations firmly established in the field may be eligible. These keywords will be used for indexing purposes. Acknowledgements Collate acknowledgements in a separate section at the end of the article before the references and do not, therefore, include them on the title page, as a footnote to the title or otherwise. List here those individuals who provided help during the research (e.g., providing language help, writing assistance or proof reading the article, etc.). Formatting of funding sources List funding sources in this standard way to facilitate compliance to funder's requirements: Funding: This work was supported by the National Institutes of Health [grant numbers xxxx, yyyy]; the Bill & Melinda Gates Foundation, Seattle, WA [grant number zzzz]; and the United States Institutes of Peace [grant number aaaa]. It is not necessary to include detailed descriptions on the program or type of grants and awards. When funding is from a block grant or other resources available to a university, college, or other research institution, submit the name of the institute or organization that provided the funding. If no funding has been provided for the research, please include the following sentence: This research did not receive any specific grant from funding agencies in the public, commercial, or not-for-profit sectors. Math formulae Please submit math equations as editable text and not as images. Present simple formulae in line with normal text where possible and use the solidus (/) instead of a horizontal line for small fractional terms, e.g., X/Y. In principle, variables are to be presented in italics. Powers of e are often more conveniently denoted by exp. Number consecutively any equations that have to be displayed separately from the text (if referred to explicitly in the text). Footnotes Footnotes should be used sparingly. Number them consecutively throughout the article. Many word processors can build footnotes into the text, and this feature may be used. Otherwise, please indicate the position of footnotes in the text and list the footnotes themselves separately at the end of the article. Do not include footnotes in the Reference list. Artwork Electronic artwork General points • Make sure you use uniform lettering and sizing of your original artwork. • Embed the used fonts if the application provides that option. • Aim to use the following fonts in your illustrations: Arial, Courier, Times New Roman, Symbol, or use fonts that look similar. • Number the illustrations according to their sequence in the text. • Use a logical naming convention for your artwork files. • Provide captions to illustrations separately. • Size the illustrations close to the desired dimensions of the published version. • Submit each illustration as a separate file. • Ensure that color images are accessible to all, including those with impaired color vision. A detailed guide on electronic artwork is available. You are urged to visit this site; some excerpts from the detailed information are given here. Formats If your electronic artwork is created in a Microsoft Office application (Word, PowerPoint, Excel) then please supply 'as is' in the native document format. Regardless of the application used other than Microsoft Office, when your electronic artwork is finalized, please 'Save as' or convert the images to one of the following formats (note the resolution requirements for line drawings, halftones, and line/halftone combinations given below): EPS (or PDF): Vector drawings, embed all used fonts. TIFF (or JPEG): Color or grayscale photographs (halftones), keep to a minimum of 300 dpi. TIFF (or JPEG): Bitmapped (pure black & white pixels) line drawings, keep to a minimum of 1000 dpi. TIFF (or JPEG): Combinations bitmapped line/half-tone (color or grayscale), keep to a minimum of 500 dpi. Please do not: • Supply files that are optimized for screen use (e.g., GIF, BMP, PICT, WPG); these typically have a low number of pixels and limited set of colors; • Supply files that are too low in resolution; • Submit graphics that are disproportionately large for the content. Color artwork Please make sure that artwork files are in an acceptable format (TIFF (or JPEG), EPS (or PDF), or MS Office files) and with the correct resolution. If, together with your accepted article, you submit usable color figures then Elsevier will ensure, at no additional charge, that these figures will appear in color online (e.g., ScienceDirect and other sites) regardless of whether or not these illustrations are reproduced in color in the printed version. For color reproduction in print, you will receive information regarding the costs from Elsevier after receipt of your accepted article. Please indicate your preference for color: in print or online only. Further information on the preparation of electronic artwork. Figure captions Ensure that each illustration has a caption. Supply captions separately, not attached to the figure. A caption should comprise a brief title (not on the figure itself) and a description of the illustration. Keep text in the illustrations themselves to a minimum but explain all symbols and abbreviations used. Tables Please submit tables as editable text and not as images. Tables can be placed either next to the relevant text in the article, or on separate page(s) at the end. Number tables consecutively in accordance with their appearance in the text and place any table notes below the table body. Be sparing in the use of tables and ensure that the data presented in them do not duplicate results described elsewhere in the article. Please avoid using vertical rules and shading in table cells. References Citation in text Please ensure that every reference cited in the text is also present in the reference list (and vice versa). Any references cited in the abstract must be given in full. Unpublished results and personal communications are not recommended in the reference list, but may be mentioned in the text. If these references are included in the reference list they should follow the standard reference style of the journal and should include a substitution of the publication date with either 'Unpublished results' or 'Personal communication'. Citation of a reference as 'in press' implies that the item has been accepted for publication. Web references As a minimum, the full URL should be given and the date when the reference was last accessed. Any further information, if known (DOI, author names, dates, reference to a source publication, etc.), should also be given. Web references can be listed separately (e.g., after the reference list) under a different heading if desired, or can be included in the reference list. Data references This journal encourages you to cite underlying or relevant datasets in your manuscript by citing them in your text and including a data reference in your Reference List. Data references should include the following elements: author name(s), dataset title, data repository, version (where available), year, and global persistent identifier. Add [dataset] immediately before the reference so we can properly identify it as a data reference. The [dataset] identifier will not appear in your published article. References in a special issue Please ensure that the words 'this issue' are added to any references in the list (and any citations in the text) to other articles in the same Special Issue. Reference management software Most Elsevier journals have their reference template available in many of the most popular reference management software products. These include all products that support Citation Style Language styles, such as Mendeley. Using citation plug-ins from these products, authors only need to select the appropriate journal template when preparing their article, after which citations and bibliographies will be automatically formatted in the journal's style. If no template is yet available for this journal, please follow the format of the sample references and citations as shown in this Guide. If you use reference management software, please ensure that you remove all field codes before submitting the electronic manuscript. More information on how to remove field codes from different reference management software. Reference style Text: Indicate references by number(s) in square brackets in line with the text. The actual authors can be referred to, but the reference number(s) must always be given. Example: '..... as demonstrated [3,6]. Barnaby and Jones [8] obtained a different result ....' List: Number the references (numbers in square brackets) in the list in the order in which they appear in the text. Examples: Reference to a journal publication: [1] J. van der Geer, J.A.J. Hanraads, R.A. Lupton, The art of writing a scientific article, J. Sci. Commun. 163 (2010) 51–59. https://doi.org/10.1016/j.Sc.2010.00372. Reference to a journal publication with an article number: [2] J. van der Geer, J.A.J. Hanraads, R.A. Lupton, 2018. The art of writing a scientific article. Heliyon. 19, e00205. https://doi.org/10.1016/j.heliyon.2018.e00205. Reference to a book: [3] W. Strunk Jr., E.B. White, The Elements of Style, fourth ed., Longman, New York, 2000. Reference to a chapter in an edited book: [4] G.R. Mettam, L.B. Adams, How to prepare an electronic version of your article, in: B.S. Jones, R.Z. Smith (Eds.), Introduction to the Electronic Age, E-Publishing Inc., New York, 2009, pp. 281–304. Reference to a website: [5] Cancer Research UK, Cancer statistics reports for the UK. http://www.cancerresearchuk.org/aboutcancer/statistics/cancerstatsreport/, 2003 (accessed 13 March 2003). Reference to a dataset: [dataset] [6] M. Oguro, S. Imahiro, S. Saito, T. Nakashizuka, Mortality data for Japanese oak wilt disease and surrounding forest compositions, Mendeley Data, v1, 2015. https://doi.org/10.17632/xwj98nb39r.1. Video Elsevier accepts video material and animation sequences to support and enhance your scientific research. Authors who have video or animation files that they wish to submit with their article are strongly encouraged to include links to these within the body of the article. This can be done in the same way as a figure or table by referring to the video or animation content and noting in the body text where it should be placed. All submitted files should be properly labeled so that they directly relate to the video file's content. In order to ensure that your video or animation material is directly usable, please provide the file in one of our recommended file formats with a preferred maximum size of 150 MB per file, 1 GB in total. Video and animation files supplied will be published online in the electronic version of your article in Elsevier Web products, including ScienceDirect. Please supply 'stills' with your files: you can choose any frame from the video or animation or make a separate image. These will be used instead of standard icons and will personalize the link to your video data. For more detailed instructions please visit our video instruction pages. Note: since video and animation cannot be embedded in the print version of the journal, please provide text for both the electronic and the print version for the portions of the article that refer to this content. Supplementary material Supplementary material such as applications, images and sound clips, can be published with your article to enhance it. Submitted supplementary items are published exactly as they are received (Excel or PowerPoint files will appear as such online). Please submit your material together with the article and supply a concise, descriptive caption for each supplementary file. If you wish to make changes to supplementary material during any stage of the process, please make sure to provide an updated file. Do not annotate any corrections on a previous version. Please switch off the 'Track Changes' option in Microsoft Office files as these will appear in the published version. Research data This journal encourages and enables you to share data that supports your research publication where appropriate, and enables you to interlink the data with your published articles. Research data refers to the results of observations or experimentation that validate research findings. To facilitate reproducibility and data reuse, this journal also encourages you to share your software, code, models, algorithms, protocols, methods and other useful materials related to the project. Below are a number of ways in which you can associate data with your article or make a statement about the availability of your data when submitting your manuscript. If you are sharing data in one of these ways, you are encouraged to cite the data in your manuscript and reference list. Please refer to the "References" section for more information about data citation. For more information on depositing, sharing and using research data and other relevant research materials, visit the research data page. Data linking If you have made your research data available in a data repository, you can link your article directly to the dataset. Elsevier collaborates with a number of repositories to link articles on ScienceDirect with relevant repositories, giving readers access to underlying data that gives them a better understanding of the research described. There are different ways to link your datasets to your article. When available, you can directly link your dataset to your article by providing the relevant information in the submission system. For more information, visit the database linking page. For supported data repositories a repository banner will automatically appear next to your published article on ScienceDirect. In addition, you can link to relevant data or entities through identifiers within the text of your manuscript, using the following format: Database: xxxx (e.g., TAIR: AT1G01020; CCDC: 734053; PDB: 1XFN). Mendeley Data This journal supports Mendeley Data, enabling you to deposit any research data (including raw and processed data, video, code, software, algorithms, protocols, and methods) associated with your manuscript in a free-to-use, open access repository. During the submission process, after uploading your manuscript, you will have the opportunity to upload your relevant datasets directly to Mendeley Data. The datasets will be listed and directly accessible to readers next to your published article online. Data in Brief You have the option of converting any or all parts of your supplementary or additional raw data into one or multiple data articles, a new kind of article that houses and describes your data. Data articles ensure that your data is actively reviewed, curated, formatted, indexed, given a DOI and publicly available to all upon publication. You are encouraged to submit your article for Data in Brief as an additional item directly alongside the revised version of your manuscript. If your research article is accepted, your data article will automatically be transferred over to Data in Brief where it will be editorially reviewed and published in the open access data journal, Data in Brief. Please note an open access fee of 600 USD is payable for publication in Data in Brief. Full details can be found on the Data in Brief website. Please use this template to write your Data in Brief. MethodsX You have the option of converting relevant protocols and methods into one or multiple MethodsX articles, a new kind of article that describes the details of customized research methods. Many researchers spend a significant amount of time on developing methods to fit their specific needs or setting, but often without getting credit for this part of their work. MethodsX, an open access journal, now publishes this information in order to make it searchable, peer reviewed, citable and reproducible. Authors are encouraged to submit their MethodsX article as an additional item directly alongside the revised version of their manuscript. If your research article is accepted, your methods article will automatically be transferred over to MethodsX where it will be editorially reviewed. Please note an open access fee is payable for publication in MethodsX. Full details can be found on the MethodsX website. Please use this template to prepare your MethodsX article. Data statement To foster transparency, we encourage you to state the availability of your data in your submission. This may be a requirement of your funding body or institution. If your data is unavailable to access or unsuitable to post, you will have the opportunity to indicate why during the submission process, for example by stating that the research data is confidential. The statement will appear with your published article on ScienceDirect. For more information, visit the Data Statement page. Online proof correction To ensure a fast publication process of the article, we kindly ask authors to provide us with their proof corrections within two days. Corresponding authors will receive an e-mail with a link to our online proofing system, allowing annotation and correction of proofs online. The environment is similar to MS Word: in addition to editing text, you can also comment on figures/tables and answer questions from the Copy Editor. Web-based proofing provides a faster and less error-prone process by allowing you to directly type your corrections, eliminating the potential introduction of errors. If preferred, you can still choose to annotate and upload your edits on the PDF version. All instructions for proofing will be given in the e-mail we send to authors, including alternative methods to the online version and PDF. We will do everything possible to get your article published quickly and accurately. Please use this proof only for checking the typesetting, editing, completeness and correctness of the text, tables and figures. Significant changes to the article as accepted for publication will only be considered at this stage with permission from the Editor. It is important to ensure that all corrections are sent back to us in one communication. Please check carefully before replying, as inclusion of any subsequent corrections cannot be guaranteed. Proofreading is solely your responsibility. Offprints The corresponding author will, at no cost, receive a customized Share Link providing 50 days free access to the final published version of the article on ScienceDirect. The Share Link can be used for sharing the article via any communication channel, including email and social media. For an extra charge, paper offprints can be ordered via the offprint order form which is sent once the article is accepted for publication. Both corresponding and co-authors may order offprints at any time via Elsevier's Author Services. Corresponding authors who have published their article gold open access do not receive a Share Link as their final published version of the article is available open access on ScienceDirect and can be shared through the article DOI link.