Cyber Crisis Management Research Articles

Improvement of Cyber Resilience by Implementation of a Digital Business Continuity Management System: Evidence from Romania

Abstract This paper aims to present a model for increasing the cyber resilience of organizations. Under the business context when cyber incidents risk is the most important risk worldwide for organizations for the third consecutive year, the model proposes a solution for improvement of cyber resilience of organizations, by implementation of a management system based on Business Continuity Management framework and a related software solution for handling the Risk Management data, Business Impact Analysis, Emergency and Recovery Planning, as well as Cyber Crisis Management. The implementation of the digital Business Continuity Management System and Cyber Crisis Management processes is tested through a simulation of a cyber incident leading to disruption of activities and cyber crisis caused by a ransomware attack. The simulation is presented both as design and execution and it can be implemented in any organization having the Business Continuity Management System in place and an internal IT department. The results of the simulation bring evidence for the contribution of the study to the increase of the cyber resilience of the organization. The novelty of the study is represented by the mix of concepts and instruments brought together in the model through which the framework of Business Continuity Management is implemented by means of a dedicated software solution, facilitating steps towards the digitization of the management processes and increase of the organizational and cyber resilience.

Regression Analysis of The National Cyber Security Index In The Southeast Asia Region

In the current era of the Industrial Revolution 4.0, information and communication technology is rapidly developing in all sectors. In the matrix of non-military defense implementation, technology is one of the dimensions that influence the achievement of a country's general defense policy. Technological development does not always have a positive impact. Cyber threats and attacks are an example of the negative impact in technological development. In the "Cyber Defense Guidelines," national cyber security is defined as all efforts to maintain the confidentiality, integrity, and availability of information and all its supporting facilities at the national level, which are cross-sectoral in nature. According to data from the National Cyber Security Index (NCSI) survey agency, a country's National Cyber Security Index (Y) is measured based on 12 indicators, including: cyber security policy development (X1), cyber threat analysis and information (X2), education and professional development (X3), contribution to global cyber security (X4), protection of digital services (X5), protection of essential services (X6), e-identification and trust services (X7), protection of personal data (X8), cyber incident response (X9), cyber crisis management (X10), fight against cybercrime (X11), and military cyber operations (X12). In this study, a regression analysis will be conducted on the 12 indicators of the National Cyber Security Index against the Total Assessment of the National Cyber Security Index (Y) in Southeast Asia, so that the type of equation in the regression analysis can be identified.

Analysis of presidential regulations concerning cyber security to bolster defense policy management

As a developing country, Indonesia must effectively manage its national defense by implementing defense policies which can be interpreted as management activities that transform into defense policy management entities. The objective is to protect against various dangerous threats resulting from the dynamics of the current strategic environment, which continues to undergo rapid and significant changes. Cyber threats pose a potentially dangerous threat that has a multidimensional impact. Therefore, this article analyzes one of the Indonesian government's efforts to deal with cyber threats, which is in the form of Presidential Regulation No. 47 of 2023. The research employs a qualitative descriptive approach in the field of literacy studies, drawing on reputable sources such as journals, books, and internet materials. It investigates the management measures and strategies implemented by Indonesia to combat cyber threats in accordance with presidential regulations for cybersecurity. These findings elaborate on the implementation of presidential regulations that concentrate on cyber crisis management and national cyber security strategy as a suitable and praiseworthy response to the constantly evolving cyber threats. Nonetheless, addressing several challenges requires strategic competencies in leadership to formulate cyber defense policies and strategies and carry them out optimally.

사이버스토킹의 실태와 대응방안에 관한 연구

Recently, in September, 2022, the so-called Sindang Station Murder in which a man obsessed with love killed a woman cruelly has been arousing public resentment. Besides, these days, cyber stalking, stalking on SNSs, is occurring in many ways; therefore, it is urgent for us to come up with countermeasures for it. Of course, the Stalking Punishment Act has been in effect since the end of 2021; however, there are a lot of difficulties in punishing cyber stalking. Now is the time to discuss countermeasures for it. The purpose of this study is to examine the concept, trend, and actual status of cyber stalking and then figure out the problems and seek effective countermeasures for it. By conducting theoretical discussion, literature review, and status diagnosis on cyber stalking and then discussing the problems and countermeasures of cyber stalking, this researcher has reached the following conclusions. First, it is necessary to establish the exclusive law of cyber stalking. Second, it is needed to define cyber stalking and punish it severely. Third, it is necessary to provide preventive education on cyber stalking. Fourth, the use of cyber crisis management and consulting services is demanded.

КІБЕРБЕЗПЕКА ЯК НАПРЯМОК ЗАХИСТУ ІНФОРМАЦІЙНОКОМУНІКАЦІЙНОГО СЕКТОРУ В СУЧАСНИХ УМОВАХ

Ensuring the protection of the information and communication sector is an important component in the country's economic growth and further progress. The issue of cyber security of the information and communication sector stands out as an important direction both at the international and at the state level. In times of war, cyber threats can have serious consequences, including financial losses, reputational damage, legal liabilities, and risks to both national security and individual sectors. It is analyzed the progress of Ukraine in cyber security based on such indicators as general security indicators, basic cyber security indicators, incident and crisis management indicators in the article. According to the Global ICT Regulatory Outlook, Ukraine ranks low in the regulation of the studied area – 78th out of 96 countries. However, Ukraine has made significant progress in cyber security, as highlighted by the Global Cyber Security Index. According to most of the general indicators, full implementation is highlighted, among the basic indicators there is a need to increase the protection of digital services, according to the indicators of incident and crisis management, military cyber operations and cyber crisis management are the least developed. Cyber threats can result in significant consequences during times of war, including financial loss, reputational damage, legal liabilities, and risks to national security. At the beginning of the war, more than 120 powerful cyber attacks on the resources of state authorities and military administration of Ukraine, as well as IT systems of critical infrastructure facilities, communication operators and mass media. Despite the positive developments, the country still faces challenges, especially in the area of protection of digital services, for which there is no competent supervisory authority. The need for cyber security in the information and communication sector and measures that can be taken to increase cyber resilience are highlighted, especially in the area of protection of digital services. Parties should cooperate with the government to improve cyber resilience. Cooperation may include sharing threat information, best practices, and resources, and coordinating incident response and recovery efforts. The issue of cyber defense of the economy in the conditions of a full-scale Russian invasion of Ukraine is gaining special relevance and is allocated to a separate direction of state policy.

Cybersecurity Policy-Related Developments in Latin America

Latin American countries begin to develop their national-level cyber policy including their cybersecurity strategy. The paper aims to provide a comparative analysis of the strategy development processes in six Latin American countries including Argentina, Brazil, Chile, Colombia, Mexico and Peru. The methodology is based on a mixed approach. For the quantitative analysis, the National Cyber Security Index and UNIDIR Cyber Policy Portal were used, while for the qualitative analysis a document analysis was carried out on the national strategies. Analysing national data based on the NCSI, Chile stands out overall, however, the country is still in the initial phase in terms of digital and essential service protection, personal data protection and cyber crisis management. Brazil’s position is interesting, standing at 3rd place overall, being the most targeted country by cyberattacks in the region. Brazil stands out in terms of cyber threat analysis and military cyber operations. Based on the document analysis, Chile and Argentina have a more holistic cybersecurity strategy, including factors such as cybersecurity education, cybercrime detection, regulatory framework, and the aim to cooperate with international and industrial partners.

China–U.S. cyber-crisis management

In the past decade, cyber security issues have led to multiple conflicts between China and the United States, resulting in significant risks and threats to the cooperation of the two countries in cyberspace. Despite early successes and failures, cyber-crisis management is still in its infancy. Challenges, such as the misreading of cyberspace strategic intentions and the ideologization of technology competition, are very real. In the future, the two sides need to work together to seek consensus on the basic principles of crisis management, emphasize the important role of academic exchanges, and take confidence-building measures to lay the foundation for cooperation in cyber-crisis management.

Airports’ Crisis Management Processes and Stakeholders Involved

Airports are exposed to various physical incidents that can be classified as aviation and non-aviation related incidents, including terrorist attacks, bombings, natural disasters (e.g. earthquake or tsunami and man-made disasters such as terrorist attacks) etc. (Kanyi, Kamau, & Mireri, 2016). In addition to this, cyber-attacks to airport operations are emerging especially with the increasing use of Information Systems (IS), such as electronic tags for baggage handling and tracking, remote check-in, smart boarding gates, faster and more reliable security screening technologies and biometric immigration controls etc. Any physical or cyber incident that causes loss of infrastructure or massive patient surge, such as natural disasters, terrorist acts, or chemical, biological, radiological, nuclear, or explosive hazards could affect the airports’ services provision and could cause overwhelming pressure. During the crisis management, several stakeholders that have different needs and requirements, get involved in the process, trying to cooperate, respond and support recovery and impact mitigation. The aim of this paper is to present a holistic security agenda that defines the stakeholders involved in the respective processes followed during the crisis management cycle. This agenda is based both on normative literature, such as relevant standards, guidelines, and practices and on knowledge and feedback extrapolated from a case study conducted in the context of the SATIE project (H2020-GA832969). In meeting paper’s aim, initially the normative review of the phases of the crisis management cycle (preparedness, response, recovery and mitigation) in the context of airports as well as general practices applied, are presented. Moreover, the key airport stakeholders and operation centres involved in airports operations, as well as during the crisis management are analysed. By combining the information collected, a holistic cyber and physical crisis management cycle including the stakeholders and the relevant processes are proposed. The crisis management process is taken into consideration into the SATIE project, which aims to build a security toolkit in order to protect critical air transport infrastructures against combined cyber-physical threats. This toolkit will rely on a complete set of semantic rules that will improve the interoperability between existing systems and enhanced security solutions, in order to ensure more efficient threat prevention, threat and anomaly detection, incident response and impact mitigation, across infrastructures, populations and environment.

Strategy for Determining Country Ranking by Level of Cybersecurity

The rapid development of the fourth industrial revolution contributed to the growth of computerization and digitalization of many spheres of society, which eventually led to the emergence of cybercrime. As a result, it is necessary to develop a cybersecurity strategy at the country level, which involves the development of effective measures to protect information. The purpose of this article is to determine the strategy for ranking countries by their level of cybersecurity. For its implementation, 12 indicators were selected that characterize various aspects of cybersecurity of countries: Cyber Security Policy Development, Cyber Threat Analysis and Information, Education and Professional Development, Contribution to global cyber security, Protection of digital services, Protection of essential services, E-identification and trust services, Protection of personal data, Cyber incidents response, Cyber crisis management, Fight against cybercrime, Military cyber operations. Their actual values were taken for 160 countries in 2018. The article proved that the existing method of determining the actual ranking of countries has a number of shortcomings, which are the lack of solutions to problems related to the dimensionality of data, determining the weights of the analyzed indicators, taking into account the diversity of indicators and their fundamental differences. To avoid these shortcomings, it is proposed to use multi-attribute decision-making methods, which are used in the decision-making process, but their capabilities allow the evaluation of ratings. The methods of TOPSIS, VIKOR and MAAM were used in the article. As a result, it was found that the rating by the MAAM method has about 25% similarity with the values of the ranking. Also, this method has most of the disadvantages inherent in the actual. The TOPSIS and VIKOR methods showed better results, which were less similar to the real values. It was found that VIKOR (v = 0.5) shows more balanced estimates than VIKOR (v = 1.0) in relation to the ranking of countries in terms of cybersecurity. VIKOR (v = 1.0) is more suitable for solving the problem of choosing alternatives than for rating. The TOPSIS method proved to be the most effective for ranking countries, which eliminates the shortcomings of the real assessment method and allows to determine the best and worst alternative, which facilitates the analysis separately for the indicators. Checking the effectiveness of the obtained ratings, using Spearman’s rank correlation coefficient, proved their effectiveness. Keywords: country, cybersecurity, MAAM, National Cybersecurity Index, rank, strategy, TOPSIS, VIKOR.

Both Sides of the Coin: The Impact of Cyber Attacks on Business Value

Cyber incidents are hitting companies and making news headlines almost every day. It is critical to investigate the impacts of these incidents on the organizations’ business value. The stock price, a widely used measurement of business value, of every victimized company fluctuates differently after a data breach. This article summarizes the factors that drive the whirling of the coin and suggests more proactive cyber crisis management to turn incidents into opportunities to create positive long-term impacts and enhance cyber resilience.

Strategic decision making in cyber security: Lessons learned

The threats to the international community currently emerging in cyber space represent great challenges to security and it is of utmost importance to be ready to respond. This calls for a stronger and more resilient community, which will be well prepared to face these new challenges. The paper considers the preparation of strategic leaders to deal with cyber space crisis management processes in the form of a European Defence Agency (EDA) tabletop exercise. This is developed from the EU approach to cyber crisis management and the efforts undertaken by the European Defence Agency and European Cyber Security Initiative (ECSI), as well as a customised scenario based upon the Austrian Cyber Security Strategy. The paper gives a brief history of the development of the cyber crisis management exercise and explains its purpose, which is to devise an exercise curriculum for a coherent conceptual toolkit that could be used in assessing current decision-making frameworks. It describes how to run such a decision-making exercise, building on concepts and methodologies used to manage a cyber security crisis. It gives an overview of typical situations, threats, nature and likelihood, possible impact and the assessment of typical cyber situations, illustrated with scenarios, frameworks and doctrines. It further deals with response management, options, decisions (outcome, execution) and success control. Last but not least, it describes lessons identified and learned, offers a short evaluation of the exercise and the process of decision making and draws some conclusions.

National cyber crisis management: Different European approaches

Cyber crises, as new forms of transboundary crises, pose serious risks to societies. This article investigates how different models of public–private partnerships shape cyber crisis management in four European countries: the Netherlands, Denmark, Estonia, and the Czech Republic. Using Provan and Kenis's modes of network governance, an initial taxonomy of cyber governance structures is provided. The Netherlands have created a participant‐governed network, characterized by trust and equality. The Czech and Estonian models resemble a network administrative organization, with an enforcement role for their national cyber security centers. Denmark has adopted a lead‐agency model. The article concludes that countries face two binary choices when organizing cyber defense and crisis management. First, national computer emergency response teams/computer security incident response teams can be embedded inside or outside the intelligence community. Second, cyber capacity can be centralized in one unit or spread across different sectors. These decisions fundamentally shape information‐sharing arrangements and potential roles during cyber crises.

Lessons from the five data breaches: Analyzing framed crisis response strategies and crisis severity

To fill a gap of research that explores cyber crisis management, this study analyzed news stories of the five largest data breaches experienced in 2014 by retailers (i.e. Target, Michaels, Neiman M...