Cybersecurity Controls Research Articles

Optimum Spending on Cybersecurity Measures: Part II

The purpose of this research is to investigate the decision-making process for cybersecurity investments in organizations through development and utilization of a digital cybersecurity risk management framework. The initial article, Optimum Spending on Cybersecurity Measures is published on Emerald Insight at: https://www.emerald.com/insight/1750-6166.htm, contains the detailed literature review, and the data results from Phase I and Phase II of this research REF _Ref61862658 \r \h \* MERGEFORMAT [1]. This article will highlight the research completed in the area of organizational decision-making on cybersecurity spend. In leveraging the review of additional studies, this research utilizes a regression framework and case study methodology to demonstrate that effective risk-based decisions are necessary when implementing cybersecurity controls. Through regression analysis, the effectiveness of current implemented cybersecurity measures in organizations is explored when connecting a dependent variable with several independent variables. The focus of this article is on the strategic decisions made by organizations when implementing cybersecurity measures. This research belongs to the area of risk management, and various models within the field of 1) information security; 2) strategic management; and 3) organizational decision-making to determine optimum spending on cybersecurity measures for risk taking organizations. This research resulted in the development of a cyber risk investment model and a digital cybersecurity risk management framework. Using a case study methodology, this model and framework were leveraged to evaluate and implement cybersecurity measures. The case study methodology provides an in-depth view of a risk-taking organization’s risk mitigation strategy within the bounds of the educational environment focusing on five areas identified within a digital cyber risk model: 1) technology landscape and application portfolio; 2) data centric focus; 3) risk management practices; 4) cost-benefit analysis for cybersecurity measures; and 5) strategic development. The outcome of this research provides greater insight into how an organization makes decisions when implementing cybersecurity controls. This research shows that most organizations are diligently implementing security measures to effectively monitor and detect cyber security attacks, specifically showing that risk taking organizations implemented cybersecurity measures to meet compliance and audit obligations with an annual spend of $3.18 million. It also indicated that 23.6% of risk-taking organizations incurred more than 6 cybersecurity breaches with an average dollar loss of $3.5 million. In addition, the impact of a cybersecurity breach on risk taking organizations is as follows: 1) data loss; 2) brand/reputational impact; 3) financial loss fines; 4) increase oversight by regulators/internal audit; and 5) customer/client impact. The implication this research has on practice is extensive, as it focuses on a broad range of areas to include risk, funding and type and impact of cyber security breaches encountered. The survey study clearly demonstrated the need to develop and utilize a digital cybersecurity risk management framework to integrate current industry frameworks within the risk management practice to include continuous compliance management. This type of framework would provide a balanced approach to managing the gap between a risk-taking organization and a risk averse organization when implementing cybersecurity measures.

Cybersecurity Resiliency of Marine Renewable Energy Systems‐Part 1: Identifying Cybersecurity Vulnerabilities and Determining Risk

AbstractTechnology innovation, market demand, and the potential impacts of a changing climate are driving the marine renewable energy (MRE) industry to develop market-ready systems to provide low-carbon electricity for emerging, off-grid markets. The advanced operational and information technology devices used in MRE systems create a pathway for a cyber threat actor to gain unauthorized access to data or disrupt operation. To improve the resiliency of MRE systems as a predictable, affordable, and reliable source of energy from oceans and rivers, guidance was developed for an end users' organization that describes a framework for identifying and managing cybersecurity risk. The development of the cybersecurity guidance is based on standards described in the Risk Management Framework and Cybersecurity Framework developed by the National Institute of Standards and Technology (NIST). This paper is the first of a two-part series that describes an approach to determine the cybersecurity risk for MRE systems based on assessing potential cyber threats, identifying vulnerabilities (people, processes, and technology, including physical and operational environment), and evaluating the consequences a cyberattack would have on operation of the MRE system and impact on end users' mission and business objectives. MRE developers and stakeholders can use this approach to assess their current cybersecurity risk posture to incorporate appropriate cybersecurity controls to reduce the consequences and impacts from a cyberattack on MRE systems. This approach can be refined further as MRE systems are deployed and operational configurations are available.

사이버 보안 체계와 전망: 미국, 영국, 일본, 한국을 중심으로

The purpose of this study began to discuss Korea"s national cybersecurity system after the 1.25 Great Depression, but still the laws and government organizations related to cybersecurity are responding individually. Therefore, it is to examine the national cybersecurity response system of Japan, which is ahead of us in the U.S., the U.K., and Asia, the major advanced countries in cybersecurity, and suggest suggestions and improvement measures for the domestic cybersecurity system. This research was conducted based on the analysis of the Cybersecurity Developed Countries Analysis Report and the Cybersecurity-related Journal published by domestic organizations. We looked at the Global Cybersecurity Index(GCI) issued annually by the ITU to look at advanced countries in cybersecurity. The first and second most advanced countries in cyber security in GCI and Japan, which has a higher level of cyber security than Korea in Asia, were selected for comparison. We compared and analyzed the major roles of government organizations and departments related to cybersecurity with Korea. Through this, I wanted to present the cyber security-related system that Korea needs to move forward and the four implications that need to be developed. According to the results of comparative analysis, this study confirmed that there are problems such as the inability to establish a system of cyber security due to the lack of unified cyber security laws and control towers in Korea compared to the major advanced countries in cyber security. In addition, this study confirmed that information security and cyber security functions are caused by distribution to various ministries.

Development of a method for quantifying relative importance of NPP cyber attack probability variables based on factor analysis and AHP

The cyber security of NPPs recently has become a major issue, and a utility in Korea is requested to follow cyber security controls and to perform cyber security risk management based on the regulatory guide RS-015. Since it is difficult to fully implement the controls with limited resources, it is necessary to find which controls are relatively more important than other controls. The aim of this study is to develop a method for quantifying the relative importance of NPP cyber attack probability variables. These variables were investigated, and rearrangement and classification of them was validated by the factor analysis method. The relative importance among the variables was quantified by the AHP method. By applying the relative importance to the regulatory guide, the controls that have higher priority to be implemented were identified. Considering the relatively more important controls, it is expected that the utility can follow cyber security controls efficiently.

Rule‐based Verification of System Security using Feature‐Based Product Line Engineering

ABSTRACTSystems security engineering is a discipline to engineer a system of interest ensuring system functionality under disruptive conditions associated with misuse and malicious behavior. Today's cyber‐physical systems must survive in a constantly changing threat environment. Cybersecurity controls and cyber resiliency capabilities require continuous delivery to meet this challenge. This article describes creating and using a rule base as an integral part of a systems and software product line engineering (PLE) factory enabling continuous resilient and secure cyber‐physical systems delivery ensuring the system can function under disruptive conditions. A hypothetical intelligence gathering network comprising unmanned vehicles, a ground control segment, and an intelligence analytics segment is the system of interest. Systems engineering activities include continuously analyzing the cyber‐attack surface for each system variant in the product portfolio; creating or amending cyber resiliency capabilities and cybersecurity controls for each system variant addressing each attack vector; and a living rule base maintained within a PLE factory ensuring each system variant automatically generated by the factory contains the requisite system capabilities. Applying this approach results in rule‐based verification of continuously delivered cyber resiliency capabilities and cybersecurity controls for each fielded system variant. Moving at the speed of mission need is essential, and automated rule‐based verification of system deliveries meets that need.

What lawyers mean by ‘reasonable’ cyber security controls

Regulators, litigators and cyber security standards require that cyber security controls should be ‘reasonable’. But rarely do these authorities define what the word means. Lawyers and regulators have long stated that reasonableness is a balance between protecting others from harm and using controls that are no more burdensome than the risks they reduce. They have illustrated this concept with a calculation that is remarkably similar to risk calculations used in cyber security risk management. This paper explores an accidental collaboration between the cyber security community, judges and regulators to define reasonableness, and demonstrates to readers how they can use risk analysis to defend their security programmes as reasonable.

Optimum spending on cybersecurity measures

PurposeThis purpose of this paper is to provide insight through analysis of the data collected from a pilot study, into the decision-making process used by organizations in cybersecurity investments. Leveraging the review of literature, this paper aims to explore the strategic decisions made by organizations when implementing cybersecurity controls, and identifies economic models and theories from the economics of information security, and information security investment decision-making process. Using a survey study method, this paper explores the feasibility for development of a strategic decision-making framework that may be used when evaluating and implementing cybersecurity measures.Design/methodology/approachA pilot study was conducted to evaluate the ways in which decisions are made as it relates to cybersecurity spending. The purpose of the pilot study was to determine the feasibility for developing a strategic framework to minimize cybersecurity risks. Phase 1 – Interview Study: The qualitative approach focused on seven participants who provided input to refine the survey study questionnaire. Phase 2 – Survey Study: The qualitative approach focused on information gathered through an online descriptive survey study using a five-point Likert scale.FindingsThe literature review identified that there is limited research in the area of information security decision making. One paper was identified within this area, focusing on the research completed by Dor and Elovici [22]. This exploratory research demonstrates that although organizations have actively implemented cybersecurity frameworks, there is a need to enhance the decision-making process to reduce the number and type of breaches, along with strengthening the cybersecurity framework to facilitate a preventative approach.Research limitations/implicationsThe partnership research design could be expanded to facilitate quantitative and qualitative techniques in parallel with equal weight, leveraging qualitative techniques, an interview study, case study and grounded theory. In-depth data collection and analysis can be completed to facilitate a broader data collection which will provide a representative sample and achieve saturation to ensure that adequate and quality data are collected to support the study. Quantitative analysis through statistical techniques (i.e. regression analysis) taking into account, the effectiveness of cybersecurity frameworks, and the effectiveness of decisions made by stakeholders on implementing cybersecurity measures.Practical implicationsThis exploratory research demonstrates that organizations have actively implemented cybersecurity measure; however, there is a need to reduce the number and type of breaches, along with strengthening the cybersecurity framework to facilitate a preventative approach. In addition, factors that are used by an organization when investing in cybersecurity controls are heavily focused on compliance with government and industry regulations along with opportunity cost. Lastly, the decision-making process used when evaluating, implementing and investing in cybersecurity controls is weighted towards the technology organization and, therefore, may be biased based on competing priorities.Social implicationsThe outcome of this study provides greater insight into how an organization makes decisions when implementing cybersecurity controls. This exploratory research shows that most organizations are diligently implementing security measures to effectively monitor and detect cyber security attacks. The pilot study revealed that the importance given to the decisions made by the CIO and Head of the Business Line have similar priorities with regard to funding the investment cost, implementing information security measures and reviewing the risk appetite statement. This parallel decision-making process may potentially have an adverse impact on the decision to fund cybersecurity measures, especially in circumstances where the viewpoints are vastly different .Originality/valueCybersecurity spend is discussed across the literature, and various approaches, methodologies and models are used. The aim of this paper is to explore the strategic decision-making approach that is used by organizations when evaluating and implementing cybersecurity measures. Using a survey study method, this paper explores the feasibility for development of a strategic decision-making framework that may be used when evaluating and implementing cybersecurity measures.

Observer‐based stability of switched system under jamming attack and random packet loss

This study investigates the cyber-security control problem of a networked switched system. Firstly, a joint probabilistic model is utilised to characterise the communication failure caused by the jamming attack and random packet loss. Then the attention is focused on designing an observer based controller that can generate the control input using the last successfully received system output. After that, with the average dwell time scheme, sufficient conditions are derived to ensure the almost sure asymptotical stability of the overall-system with stable and unstable subsystems. In addition, an approach is developed to obtain the feasible solution of state feedback and observer gains. Finally, a simulation example implies the effectiveness of the authors' methods.

Detection and mitigation of cyber-threats in the DC microgrid distributed control system

This paper addresses the cyber-threat detection and mitigation in a DC microgrid distributed control system. Due to the deployment of communication and control technologies, a DC microgrid resembles a cyber-physical system that is highly exposed to cyber-threats. A cyber-threat detection technique is proposed that relies on a Kullback-Liebler divergence-based criterion. This criterion detects the misbehavior of a compromised Distributed Energy Resource (DER) control unit and, consequently, calculates an interior-belief factor and communicates it with its neighboring DERs to inform them of the reliability of its outgoing information. Moreover, DERs calculate an exterior-belief value related to the trustworthiness of the received information from neighbors. The cyber-threat mitigation technique at each DER utilizes the neighbors' interior-belief and its own calculated exterior-belief value for neighboring DERs to slow down and eventually mitigate attacks. The proposed approach requires a communication network with mild graph connectivity. A typical medium-voltage DC microgrid system is simulated to verify the validity of proposed distributed cyber-secure control scheme. It is shown that using the proposed cyber-secure approach, the voltage of a critical bus of microgrid is well regulated and DERs can successfully distinguish cyber-attacks from legitimate events.

Development of a quantitative method for identifying fault-prone cyber security controls in NPP digital I&C systems

The nuclear regulatory organizations have developed the regulatory guidance for assessment and selection of cyber security controls. One of the important considerations is that the performance and reliability of safety-grade software system must not be degraded by the cyber security controls. However, the nuclear industry has difficulty in applying and verifying the cyber security controls because of the complicated structure of digital I&C systems and the vast amount of cyber security controls. In this study, in order to solve the problem, a cyber security control V&V process model is developed based on the concept of adaptive focusing testing. In addition, a quantitative method for identifying and prioritizing fault-prone cyber security controls is developed. It was confirmed that the developed model can provide an additional and more objective context for the subjective judgement of experts.

Detection and Mitigation of Data Manipulation Attacks in AC Microgrids

This paper presents a resilient control framework for distributed frequency and voltage control of AC microgrids under data manipulation attacks. In order for each distributed energy resource (DER) to detect any misbehavior on its neighboring DERs, an attack detection mechanism is first presented using a Kullback-Liebler (KL) divergence-based criterion. An attack mitigation technique is then proposed that utilizes the calculated KL divergence factors to determine trust values indicating the trustworthiness of the received information. Moreover, DERs continuously generate a self-belief factor and communicate it with their neighbors to inform them of the validity level of their own outgoing information. DERs incorporate their neighbors' self-belief and their own trust values in their control protocols to slow down and mitigate attacks. It is shown that the proposed cyber-secure control effectively distinguishes data manipulation attacks from legitimate events. The performance of proposed secure frequency and voltage control techniques is verified through the simulation of microgrid tests system implemented on IEEE 34-bus test feeder with six DERs.

POSITIONING CYBERSECURITY IN THE C-SUITE: HOW TO BUILD A JOINT SECURITY OPERATIONS CENTER

ABSTRACTThis paper argues that the creation of a Joint Security Operations Center (JSOC) must be coordinated, implemented, and administered by a single dedicated entity, one that operates at the highest level of organizational authority to ensure proper coordination and enforcement. Currently, not one sector in the U.S.’s national infrastructure have yet to come up with an effective strategy or a coherent scheme to protect itself from a concerted cyberattack. Therefore, it is critically important that we begin to get our act together in cyberspace. Electronic, personnel, and physical security are separate operations in most companies. So, in essence, the separation of functions has created three wobbly one-legged stools instead of one solid three-legged stool. Thus, we need a single unified point to create and manage a complete, rational, organization-wide cybersecurity control system. In essence, a complete cybersecurity response requires expertise in electronic, behavioral, and physical security operations and the key to success lies in the proper placement. The obligation for creating and sustaining this strategic function lies with corporate leadership, not the people down the organizational ladder in IT. The converged approach is essential because monitoring and enforcement is cross functional and comprehensive.

Matching training to individual learning styles improves information security awareness

Purpose This paper aims to introduce the concept of a framework of cyber-security controls that are adaptable to different types of organisations and different types of employees. One of these adaptive controls, namely, the mode of training provided, is then empirically tested for its effectiveness. Design/methodology/approach In total, 1,048 working Australian adults completed the human aspects of the information security questionnaire (HAIS-Q) to determine their individual information security awareness (ISA). This included questions relating to the various modes of cyber-security training they had received and how often it was provided. Also, a set of questions called the cyber-security learning-styles inventory was used to identify their preferred learning styles for training. Findings The extent to which the training that an individual received matched their learning preferences was positively associated with their information security awareness (ISA) level. However, the frequency of such training did not directly predict ISA levels. Research limitations/implications Further research should examine the influence of matching cyber-security learning styles to training packages more directly by conducting a controlled trial where the training packages provided differ only in the mode of learning. Further research should also investigate how individual tailoring of aspects of an adaptive control framework (ACF), other than training, may improve ISA. Practical implications If cyber-security training is adapted to the preferred learning styles of individuals, their level of ISA will improve, and therefore, their non-malicious behaviour, whilst using a digital device to do their work, will be safer. Originality/value A review of the literature confirmed that ACFs for cyber-security does exist, but only in terms of hardware and software controls. There is no evidence of any literature on frameworks that include controls that are adaptable to human factors within the context of information security. In addition, this is the first study to show that ISA is improved when cyber-security training is provided in line with an individual’s preferred learning style. Similar improvement was not evident when the training frequency was increased suggesting real-world improvements in ISA may be possible without increasing training budgets but by simply matching individuals to their desired mode of training.

The Winds of Change in World Politics and the Impact on Cyber Stability

One of the greatest geopolitical challenges in the 21st century will be competing for the control of cyberspace, the 5th domain of cyberwarfare after land, sea, air, and space, and the major economic challenge of the time. With the advancement of artificial intelligence, the Internet of Things, autonomous vehicles, and unmanned drones, this challenge becomes even greater. This article explores through empirical evidence the interaction among the three powers that shape cyber intelligence and international security: globalism, regionalism, and nationalism. Recently, world politics has created a sense of urgency concerning the new world order and what that means for cyber security and the domain of cyberspace. With the recent cyberattacks targeting the American political system, the Foreign Ministry of the Czech Republic, the government of Croatia, and the 2017 attacks on the cyber systems operated by the Ukrainian government, there is concern about the stability of global connectedness and the potential for diminution of global boundaries. The concern about global stability raises the question of who controls cyberspace and who is accountable when things go wrong. The aim of the article is to advance a conceptualization for cyber governance frameworks for better control of cyber security by governments, intergovernmental organizations, and the private sector.

The impact of foreignness on the compliance with cybersecurity controls

This study examines whether and how foreignness affects internal auditors’ compliance with the International Standards for the Professional Practice of Internal Auditing (the Standards) from social and culture perspective. It demonstrates that foreignness, such as language and relational social capital, has a significant impact on auditors’ compliance with the Standards, especially with respect to cybersecurity, independence and objectivity, individual objectivity, and governance of the Standards. The Partial Least Squares Structural Equation Modelling (PLS-SEM) is used to analyze the survey data. This study highlights that external factors such as social capital affect the internal auditors’ compliance with the Standards.

VALIDATING CORE CONCEPTS OF CYBERSECURITY CONTROL USING COMMONLY ACCEPTED STANDARDS

ABSTRACTExpert models specify repeatable actions that are designed to ensure an organization’s resources are utilized for maximum effectiveness. Therefore, a commonly accepted expert model can serve as the basis for defining and enforcing a satisfactory degree of cybersecurity for any organization. In that respect then, expert models serve as a fixed point of reference for instituting specific cybersecurity control. This paper discusses the evolution of cybersecurity expert models, core knowledge elements, and the areas of agreement between the common expert models.

Human factor security: evaluating the cybersecurity capacity of the industrial workforce

As cyber-attacks continue to grow, organisations adopting the internet-of-things (IoT) have continued to react to security concerns that threaten their businesses within the current highly competitive environment. Many recorded industrial cyber-attacks have successfully beaten technical security solutions by exploiting human-factor vulnerabilities related to security knowledge and skills and manipulating human elements into inadvertently conveying access to critical industrial assets. Knowledge and skill capabilities contribute to human analytical proficiencies for enhanced cybersecurity readiness. Thus, a human-factored security endeavour is required to investigate the capabilities of the human constituents (workforce) to appropriately recognise and respond to cyber intrusion events within the industrial control system (ICS) environment.,A quantitative approach (statistical analysis) is adopted to provide an approach to quantify the potential cybersecurity capability aptitudes of industrial human actors, identify the least security-capable workforce in the operational domain with the greatest susceptibility likelihood to cyber-attacks (i.e. weakest link) and guide the enhancement of security assurance. To support these objectives, a Human-factored Cyber Security Capability Evaluation approach is presented using conceptual analysis techniques.,Using a test scenario, the approach demonstrates the capacity to proffer an efficient evaluation of workforce security knowledge and skills capabilities and the identification of weakest link in the workforce.,The approach can enable organisations to gain better workforce security perspectives like security-consciousness, alertness and response aptitudes, thus guiding organisations into adopting strategic means of appropriating security remediation outlines, scopes and resources without undue wastes or redundancies.,This paper demonstrates originality by providing a framework and computational approach for characterising and quantify human-factor security capabilities based on security knowledge and security skills. It also supports the identification of potential security weakest links amongst an evaluated industrial workforce (human agents), some key security susceptibility areas and relevant control interventions. The model and validation results demonstrate the application of action research. This paper demonstrates originality by illustrating how action research can be applied within socio-technical dimensions to solve recurrent and dynamic problems related to industrial environment cyber security improvement. It provides value by demonstrating how theoretical security knowledge (awareness) and practical security skills can help resolve cyber security response and control uncertainties within industrial organisations.

Standards with cybersecurity controls for smart grid—A systematic analysis

SummaryIn recent years, numerous standards related to the cybersecurity of smart grids have been published, which led to the challenge for operators in obtaining indications that match their specific objectives and contexts. Although several studies approached this problem by providing more or less comprehensive surveys and overviews of smart grid cybersecurity standards, none of them was dedicated to the actual and important subject of cybersecurity controls. This paper aims at filling this gap. A systematic literature analysis was conducted which resulted in the identification of 19 broadly recognised standards that specify cybersecurity controls applicable to the smart grid infrastructure. The publications are described in respect to the controls they define and referred to evaluation criteria. In result, this paper constitutes a guideline on standardised cybersecurity controls for smart grids, where (criteria‐based) indications help to select standards for a particular smart grid area or specific goals. The method of the research as well as the standards' selection and evaluation criteria are presented.

Obtaining reasonable assurance on cyber resilience

Purpose The purpose of this paper is to highlight the potential of cyber-testing techniques in assessing the effectiveness of cyber-security controls and obtaining audit evidence. Design/methodology/approach The paper starts with an identification of the applicable cyber-testing techniques and evaluates their applicability to generally accepted assurance schemes and cyber-security guidelines. Findings Cyber-testing techniques are providing insight in the effectiveness of the actual implementation of cyber-security controls, which may significantly deviate from the conceptual designs of these controls. Furthermore, cyber-testing techniques could provide concise input for cyber-risk management and improvement recommendations. Originality/value The presented cyber-testing techniques could complement traditional process-oriented assurance techniques with specialized technical analyses of real-world implementations that focus on the adversaries’ viewpoint.

A Survey: Agent-based Software Technology Under the Eyes of Cyber Security, Security Controls, Attacks and Challenges

Recently, agent-based software technology has received wide attention by the research community due to its valuable benefits, such as reducing the load on networks and providing an efficient solution for the transmission challenge problem. However, the major concern in building agent-based systems is related to the security of agents. In this paper, we explore the techniques used to build controls that guarantee both the protection of agents against malicious destination machines and the protection of destination machines against malicious agents. In addition, statistical-based analyses are employed to evaluate the level of maturity of the protection techniques to preserve the protection goals (the code and data, state, and itinerary of the agent), with and without the threat of attacks. Challenges regarding the security of agents are presented and highlighted by seven research questions related to satisfying cyber security requirements, protecting the visiting agent and the visited host machine from each other, providing robustness against advanced attacks that target protection goals, quantifying the security in agent-based systems, and providing features of self-protection and self-communication to the agent itself.