Cyber Protection Research Articles

Cybersecurity capabilities for critical infrastructure resilience

PurposeFor many innovative organisations, Industry 4.0 paves the way for significant operational efficiencies, quality of goods and services and cost reductions. One of the ways to realise these benefits is to embark on digital transformation initiatives that may be summed up as the intelligent interconnectivity of people, processes, data and cyber-connected things. Sadly, this interconnectivity between the enterprise information technology (IT) and industrial control systems (ICS) environment introduces new attack surfaces for critical infrastructure (CI) operators. As a result of the ICS cybersecurity risk introduced by the interconnectivity between the enterprise IT and ICS networks, the purpose of this study is to identify the cybersecurity capabilities that CI operators must have to attain good cybersecurity resilience.Design/methodology/approachA scoping literature review of best practice international CI protection frameworks, standards and guidelines were conducted. Similar cybersecurity practices from these frameworks, standards and guidelines were grouped together under a corresponding National Institute of Standards and Technology (NIST) cybersecurity framework (CF) practice. Practices that could not be categorised under any of the existing NIST CF practices were considered new insights, and therefore, additions.FindingsA CI cybersecurity capability framework comprising 29 capability domains (cybersecurity focus areas) was developed as an adaptation of the NIST CF with an added dimension. This added dimension emphasises cloud computing and internet of things (IoT) security. Each of the 29 cybersecurity capability domains is executed through various capabilities (cybersecurity processes and procedures). The study found that each cybersecurity capability can further be operationalised by a set of cybersecurity controls derived from various frameworks, standards and guidelines, such as COBIT®, CIS®, ISA/IEC 62443, ISO/IEC 27002 and NIST Special Publication 800-53.Practical implicationsCI sectors are immediately able to adopt the CI cybersecurity capability framework to evaluate their levels of resilience against cyber-attacks, given new attack surfaces introduced by the interconnectivity of cyber-connected things between the enterprise and ICS levels.Originality/valueThe authors present an added dimension to the NIST framework for CI cyber protection. In addition to emphasising cryptography, IoT and cloud computing security aspects, this added dimension highlights the need for an integrated approach to CI cybersecurity resilience instead of a piecemeal approach.

A Study on Command and Control Through Cyber Protection Function Analysis

Cyber threats can bypass existing cyber-protection systems and are rapidly developing by exploiting new technologies such as artificial intelligence. In order to respond to such cyber threats, it is important to improve the ability to detect unknown cyber threats by correlating heterogeneous cyber protection systems. In this paper, to enhance cyber-attack response capabilities, we proposed command and control that enables rapid decision-making and response before the attack objectives are achieved, using Lockheed Martin's cyber kill chain and MITRE ATT&CK to analyze the purpose and intention of the attacker.

The Application of the Federal Trade Commission Privacy and Safeguards Rules to the In the Matter Tax Slayer, LLC Case

This paper discusses what legally happened to TaxSlayer, LLC after a cyber break-in that occurred in 2015. The Federal Trade Commission sued the company, demanding that the organization institute robust cyber protections to ensure financial customer information security, confidentiality, and integrity. The article argues that the federal government’s actions were entirely appropriate, given its constitutional mandate to regulate commerce and protect the general welfare. However, with the relentless onslaught of cybercriminal activity, the steps demanded by the federal government may prevent, but not stop, the cybercriminal tide from rising, as King Canute observed many years ago.

How the installation of national security certificate in Kazakhstan brought new social media discussions on cyberspace regulations

In 2019, the Kazakhstani government attempted to embed the installation of a national security certificate within the country. The introduction of such a certificate was explained by the need to strengthen the cyber protection of citizens, state bodies, private companies from activities of Internet fraudsters and other types of cyber threats. However, citizens alongside local and international experts did not entirely welcome and accept this decision by voicing their dissent towards it. Criticism towards the installment of national security certificate ranged from infringements concerning personal data rights of citizens and companies towards an act of state apparatus espionage on sensitive private information. The thematic focus of the paper concerns the problem of mass communication and realm of media rights. Structurally, the paper first describes how the national security certificate was introduced and has originated in Kazakhstan. Then the paper analysis the various reasons and arguments in favor or against the introduction of a national security certificate. Here, viewpoints from different stakeholders were considered, such as by state ministries, Kcell and Activ mobile operators, ordinary citizens or local experts like Dossym Satpayev. Lastly, a thorough analysis of present and future outlooks on the development of national security certificate in Kazakhstan is discussed. A discourse analysis approach is applied as a research method with secondary sources of information used. The goal of this concise but informative article is to highlight both the development and the inter-relationship between the society and state what concerns national policies within the cyber realm. The significance of this paper is that it should help scholars in identifying new domestic issues studying in the field of journalism or public policy. In conclusion, the results and discussions of this paper showed us the practical and theoretical importance of how a national policy and its security certificate project generated both public dissatisfaction and new social movements concerning cyberspace aspects, but also a new testing ground for pilot projects in testing people’s readiness for accepting new cyberspace regulations. Keywords: national security certificate; Kazakhstan; Internet blocking; mobile operators; human rights.

Analysis and Classification of Mitigation Tools against Cyberattacks in COVID-19 Era

The COVID-19 outbreak has forced businesses to shift to an unprecedented “work from home” company environment. While this provides advantages for employees and businesses, it also leads to a multitude of shortcomings, most prevalent of which is the emergence of additional security risks. Previous to the outbreak, company computer networks were mainly confined within its facilities. The pandemic has now caused this network to “spread thin,” as the majority of employees work remotely. This has opened up a variety of new vulnerabilities, as workers’ cyber protection is not the same at home as it is in office. Although the effects of the virus are now subsiding, working remotely has embedded itself as the new normal. Thus, it is imperative for company management to take the necessary steps to ensure business continuity and be prepared to deal with an increased number of cyber threats. In our research, we provide a detailed classification for a group of tools which will facilitate risk mitigation and prevention. We also provide a selection of automated tools such as vulnerability scanners, monitoring and logging tools, and antivirus software. We outline each tool using tables, to show useful information such as advantages, disadvantages, scalability, cost, and other characteristics. Additionally, we implement decision trees for each category of tools, in an attempt to assist in navigating the large amount of information presented in this paper. Our objective is to provide a multifaceted taxonomy and analysis of mitigation tools, which will support companies in their endeavor to protect their computer networks. Our contribution can also help companies to have some type of cyber threat intelligence so as to put themselves one step ahead of cyber criminals.

Аналіз вимог до кіберзахисту автоматизованих систем управління технологічними процесами як об’єктів критичної інформаційної інфраструктури

The analysis of the current legislation and the best world practices on cyber protection of automated control systems of technological processes in which requirements for realization of cyber protection of objects of critical information infrastructure are offered is carried out. Problematic issues related to cyber security of critical information infrastructure objects are given.

ВИЯВЛЕННЯ ТА ОЦІНЮВАННЯ КІБЕРАТАК В ІНФОРМАЦІЙНИХ МЕРЕЖАХ ІЗ ВИПАДКОВИМ МОМЕНТОМ ПОЯВИ

Detection, prevention or significant impediment to cyberattacks (CA) is one of the central areas of cybersecurity in information networks. Determining the generalized requirements for cyber protection of information networks from cyberattacks on information and assessing the degree of their security are quite difficult tasks. There are real possibilities for unforeseen situations as a result of cyberattacks, leading to the loss of information or to its loss and loss of information network. The concept of cybersecurity of the information network on the basis of threats from cyberattacks should determine the necessary tools, methods and procedures for detection and evaluation of cyberattacks in networks. Therefore, for the effective functioning of information networks in modern conditions and means of their protection, as well as for the reliable detection and evaluation of cyberattacks, it is necessary to develop new approaches and methods, their implementation. Some results related to joint sequential detection and evaluation were obtained in [3]. As follows from [3], in the general case, is not possible to find a constructive solution even in the two-alternative problem. Losses in the process of recognition (detection) and evaluation of a cyberattack depend on both errors in its detection and inaccuracy of evaluation, which will not provide adequate response, and there is a problem of joint development and evaluation [1, 2]. Therefore, we will try to solve this problem of multi-alternative sequential detection and evaluation of a cyberattack with a random moment of its occurrence. Consistent detection and evaluation procedures are generally more efficient than inconsistent ones. Therefore, it is important and urgent to find optimal, consistent or close to them procedures that will increase the cybersecurity of information. The purpose of the article is to find optimal, consistent or close to them procedures that will increase the cybersecurity of information. Based on the probabilistic assessment, the optimal, sequential or close to them procedures are revealed in the work, which allow to increase the cybersecurity of information. The problem to build the optimal N-truncated sequential procedure for joint detection of cyberattacks (CA) and to estimate the moment of its occurrence in the loss function was solved. Statistics related to the average volume of the forecast (UOP) are analyzed. A general view of the optimal procedure for sequential detectionevaluation of a cyberattacks with an unknown moment of occurrence during these losses is proposed. Thus, if the optimal procedure is based on comparing one-dimensional statistics Ln c with a deterministic threshold for solving the problem of detection without estimating the moment of cyberattacks or for solving the problem of detection and evaluation separately, then the optimal areas for stopping and continuation of observations are determined in three-dimensional space for solving these problems.

MODELS AND METHODS FOR DIAGNOSING ZERO-DAYTHREATS IN CYBERSPACE

The article is devoted to the development of models and methods for detectingZero-Daythreats in cyberspace to improve the efficiency of detecting high-level malicious complexes that are using polymorphic mutators. Themethod for detecting samplesby antivirus solutions using a public and local multiscanneris proposed. Themethod for diagnosing polymorphic malware using Yara rules is being developed. The multicomponent service that allows organizing a free malware analysis solution with a hybrid deploy-ment architecture in public and private clouds is described. The cloud service for detecting malware based on open-source sandboxes and MAS, allowing horizontal scalability in hybrid clouds, and showing high capacity during malicious and non-maliciousobjectprocessing is designed. The main task of the service is to collect artifacts after dynamic and static object analysis to detect zero-daythreats. The effectiveness of the proposed solutions is shown.Scientific novelty and originality consist in the creation of the follow-ing methods:1) detecting the sample by preinstalled antivirus solutions that allow static scanning in separate threads without requests restrictions for increasing the malware processing speed and restrict public access to confidential files;2) diagnosing polymorphic malware using Yara rules, that allows detecting new modifications that are not detected by available solutions.The proposed hybrid system architecture allows to perform a retrospective search by families, tracking changes in destructive components, collect the malicious URLs database to block traffic to C&C servers, collect dropped and downloaded files, analyze phishing emails attach-ments, integrate with SIEM, IDS, IPS, antiphishing and Honeypot systems, improve the quality of the SOC analyst, decrease the incidents response times and block new threats that are not detected by available antivirus solutions. The practical significance of the results is in the cloud service development that combines MAS Sandbox and a modified distributed Cuckoo sandbox, which allows to respond to Zero-Day threats quickly, store a knowledge base for artifacts correlation between polymorphic malware samples, actively search for new malware samples and integrate with cyber protection hardwareand software systems that support the Cuckoo API.

Security in Cyberspace in the Field of International Relations

: As cyberspace expands and globalizes, we are experiencing a new layer of threats to governments in the form of cyber threats that have impacted various facets of national security, including social, economic, military, and political security. As a result, in the form of electronic warfare, it has developed a new kind of war and conflict. Therefore, it has impacted international security, necessitating solutions to minimize the harm caused by this form of threat and preserve international security. So, network security has brought to light some of the underlying tensions between international rivalry and cybersecurity cooperation. Thus, the current study employs a descriptive-analytical method to investigate and analyze the role of international organizations, especially the Organization for Economic Cooperation and Development, in the development of cyberspace security. The hypothesis raised in this study is that since governments are increasingly relying on unilateral policies and resources to ensure cyber protection, international organizations should play an active role in shaping cooperation among their members in the form of approaches focused on international cooperation on cybersecurity and the prevention of cyber threats, as well as the development of a global cybersecurity system.

БАЗОВА МНОЖИНА УЗАГАЛЬНЕНИХ КРИТЕРІЇВ ВІДНЕСЕННЯ ОБ’ЄКТІВ ДО КРИТИЧНОЇ ІНФРАСТРУКТУРИ ДЕРЖАВИ

The lack of registers of critical infrastructure of the state and their information and telecommunication systemsleads to uncertainty in the amount of resources needed to protect them from possible cyberattacks. Given the limitations of© Dreis Y., Derkach L., Basic set of generalized criteria for assigning objects to the critical infrastructure of state // Ukrainian Scientific Journal ofInformation Security, 2021, vol. 27, issue 1, pp. 13-20.20such resources, an important and relevant scientific and practical task is to determine the completeness and priority of cyberprotection of these objects. The formation of such registers is based on the method of assigning objects to the critical infrastructure of the state, including on the relevant criteria that will determine the affiliation of a particular object to one that iscritical to the state. The analysis of the existing criteria for classifying objects as critical infrastructure of the state shows thatin Ukraine there are a number of other criteria (and which should also be taken into account) involved in the formation ofregisters of important objects for the state, such as "State Register of Potentially Dangerous Objects". Therefore, it is proposed to form a list of such generalized criteria for classifying objects as critical infrastructure of the state in the form of abasic set, which integrates ten features with the possibility of further expansion. This set can be used to determine the priorityof cyber protection of information and telecommunications systems (critical information infrastructure facilities) of criticalinfrastructure facilities of the state.

WITHDRAWN: A novel study of preventing the cyber security threats

The aim of the analysis is to determine the vulnerabilities that could cause hundreds of billions of dollars in companies to be lost due to a cyberattacks. The paper goes on to clarify how these challenges manifest themselves, their history, and how they have changed over time. Another article cited in this work provides two scientific case studies on cyber defense. Cybersecurity can be partially described as solving problems and partially mitigating risks. It can be described as an event which intends to injure, particularly in regard to sensitive information, or function as a danger, or as well as one which simply one which causes disturbances in any sort of advanced existence. In addition to network attacks, including PC viruses, knowledge breaks, Distributed Denial of Service (DDoS) and numerous other assault vectors. a fruitful hack that would try to gain unauthorized access to your PC, licensed goods, or collect sensitive information cyber protection may be achieved by expansion or obscurity depending on whether it originators (client or system) are close to the organization or far away. Cyber Security searches for real-time access to latest information in the field of information technology. With today's world so interdependent on electronic technology, preserving data has become an overwhelming issue. Because of its foremost thought is the threat of a colossally everyday online violence, cyber defense develops to be very involved. There are various steps being taken to deal with these computer crimes through administrations and organizations. While cyber security is an important issue to most, it has not yet gained sufficient interest from general population participants. The paper mostly deals with the topic of cyber security and its problems. Today's relevant discussions on cyber security revolve around how it is increasing importance and how it can affect the organization.

Some issues of improving state planning in the sphere of cyber security in conditions of hybrid threats

The main principles of state strategic planning in the sphere of cybersecurity are considered. The directions of improvement of public administration in the field of cyber protection of a critical information infrastructure and state information resources are identified. The shortcomings of the Cyber Security Strategy of Ukraine in 2016 are analyzed and summarized. The draft of Cyber Security Strategy of Ukraine for 2021 – 2025 is considered and directions for its improvement are proposed. The prospects of strategic state planning in the sphere of cybersecurity in the context of the spread of hybrid threats are outlined.

ADMINISTRATIVE AND LEGAL CONTENT OF THE NATIONAL CYBERSECURITY SYSTEM AS A COMPONENT OF THE NATIONAL SECURITY SYSTEM OF UKRAINE

The article offers for consideration the author's results of determining the conceptual provisions of the administrative and legal content of the national cybersecurity system as a component of the national security system of Ukraine. The content of the current state of state policy in the field of formation of the cybersecurity system is considered. Theoretical and practical aspects of organizational support of the cybersecurity system are analyzed. General and special subjects of cybersecurity are identified. The own vision of the following main elements in the system of cyber security of Ukraine (according to the main types of threats to cybersecurity) is proposed: 1) national system of combating cybercrime; 2) national system for combating cyberterrorism; 3) a nationwide system for combating cyber espionage; 4) national system of counteraction to information wars and new complex types of threats, including hybrid wars; 5) national system of cyber protection of national critical infrastructure. The administrative and legal understanding of the concept of national cybersecurity system is established – a set of special subjects of the national cybersecurity system, means and methods used by them, as well as a set of relevant interconnected information, cybernetic, legal, organizational, technical and strategic communications measures carried out by them. It is concluded that since the national security system is multicomponent, there is a need for a special subsystem, the purpose of which would be to ensure the functioning and development of this system, ie to ensure the viability of its system-forming elements, including national interests, society, state. Such a system is the national security system, as well as the national cybersecurity system. These factors confirm the conclusion that the national cybersecurity system is considered not only as a subsystem of the state information policy, but also primarily as a component of the national security system of Ukraine.

Cybercrime in Local Authorities: A Case Study of the Bulawayo City Council

The study sought to evaluate the impact of cybercrime practice in local authorities with special reference to Bulawayo City Council. Zimbabwean organizations both private and public, including local authorities have not been spared by the effects of cybercrime. Given this susceptibility to risk there was a deficit of cyber security best practices at the Bulawayo City Council. Chapter two of the study reviewed past works in terms of which the conceptual framework, theoretical framework and empirical framework were highlighted. The study was based on the routine activities theory that expressed that cybercrime even in local authorities was ordinary and it just required opportunity. Chapter three highlighted the research methodology. The research was largely based on a case of the Bulawayo City Council; hence the design used was a case study. The defense for using the case study was that the research evaluated the impact of cybercrime practice in local authorities with special reference to Bulawayo City Council. An aggregate of 93 respondents were sampled using judgmental sampling. The results showed that illegal access to computer systems, illegal interference and identity theft were amongst the types of cybercrime faced whilst worker training was the major strategy to fight cybercrime. Basing on the results, it was concluded that cybercrime was predominant in local authorities, with hacking, identity theft, phishing and scamming inter alia being the greatest risks faced. It was recommended that in reply to governmental and business requirements for cyber-protection specialists and personnel growth requirements, academic bodies could create specific learning programmes and courses to unite information and research, and intensify synergies in understanding cyber protection.

Explainable artificial intelligence (XAI) interactively working with humans as a junior cyber analyst

There are many applications where artificial intelligence (AI) can add a benefit, but this benefit may not be fully realized, if the human cannot understand and interact with the output as required by their context. Allowing AI to explain its decisions can potentially mitigate this issue. To develop effective explainable AI methods to support this need, we need to understand both what the human needs for decision-making, as well as what information the AI has and can make available. This paper presents an example case of capturing those requirements. We explore how an operational planner (senior human analyst) for a cyber protection team could use a junior analyst virtual agent to scour, analyze, and present the data available on vulnerabilities and incidents on both the target systems as well as similar systems. We explore the interactions required to understand these outputs and to integrate additional knowledge held by the human. This is an exemplar case for integrating XAI into the real-world bi-directional workflow: the senior analyst needs to be able to understand the junior analysts results, particularly the assumptions and implications, in order to create a plan and brief it up the command chain. He or she may have further questions, or analysis needs to achieve this understanding. The application is the junior analyst agent and senior human analysts working together to create this understanding of threats, vulnerabilities, incidents, likely future attacks, and counteractions on the mission relevant cyber terrain that their unit has been assigned a mission on.

Ensuring cyber protection of a computer network object of information activity

Ways to obtain unauthorized information on computer networks and threats to cyber security in them are described. It is shown that in order to ensure reliable protection of information in computer systems, in addition to ensuring the security of information in the network, it is necessary to ensure the security of the physical environment of the computer network. It is recommended to use the recommendations of the X.805 standard to ensure the security of information on the computer network.

Cybersecurity Management for Virtual Private Network (VPN) Applications: A Proposed Framework for the Governance of their Use in the Kingdom of Saudi Arabia

By using the research process, this study addresses the attitudes of the members of Saudi society towards using Virtual Private Network (VPN) applications and the former’s perceptions of the latter’s concept, security, and privacy, in addition to monitoring their risks to cybersecurity. The main objective of the study is to present a proposed framework for the governance of the use of VPN applications in the Kingdom of Saudi Arabia to strengthen cybersecurity management. To achieve the objectives of the study, the researchers used two methods: the social survey method and the content analysis method. The researchers also relied on the questionnaire tool to collect information from the 455 individuals in the study sample. The study yielded a set of findings, the most important of which are as follows: The use of free VPN applications represents 91% of the sample of the study. Also, the study revealed confusion in perceptions of the actual concept of VPN applications, which may be common among users, and showed a diversity of attitudes and motives for using VPN applications, most of which are related to entertainment. Moreover, the study showed that the study sample individuals had some knowledge about the risks of VPN applications to cybersecurity, although most of them did not use cyber protection means. The study recommended the need to organize and manage the use of VPN applications, conduct an evaluation of VPN applications available on Saudi smartphone stores, and prohibit those which contain security vulnerabilities and malware. The study proposed a framework for the governance of the use of VPN applications in the Kingdom of Saudi Arabia, which comprised three dimensions: legal, organizational and awareness-based dimensions.

Cyber Security Challenges and its Emerging Trends on Latest Technologies

Today, due to the modern life style people have joined technology life and using more technology for shopping as well as financial transactions in their cyber space. At the same time, safeguarding of knowledge has become increasingly difficult. In addition, the heavy use and growth of social media, online crime or cybercrime has increased. In the world of information technology, data security plays a significant role. The information security has become one of today’s main challenges. Whenever we think of cyber security, we first of all think of ‘cybercrimes,’ which expand tremendously every day. Different government and businesses take various steps to avoid this form of cybercrime. In addition to numerous cyber protection initiatives, many people are also very worried about it. This paper focuses primarily on cyber security concerns related to the new technology. It also concentrates on the new technologies for cyber security, ethics and developments that impact cyber security.

Mathematical Study of Advanced Persistent Threat (APT) Hunting Techniques

The paper documents, based mainly on [3]-[6] published papers where a consistent mathematical description of cyberspace and various types of Cyber-Attacks and protection measures are presented, a holistic mathematical approach to a rigorous description of Advanced Persistent Threat (APT) actors’ modus operandi through various scenarios and Cyber Kill Chain stages [2]. After referring [6] to the various elements of Cyber-Attacks we propose some techniques (via 5 scenarios) of tracking the modus operandi of the most sophisticated and non-linear cyber actors, the Advanced Persistent Threat actors that are usually nation-state or nation-state backed and usually stay undetected for an extended time in later stages of Cyber Kill Chain in defenders’ networks. Keywords: Valuation of cyber assets, vulnerability of cyber assets, node supervision, sophistication of an attack germ of cyber-attack, cyber defense, proactive cyber protection, Advanced Persistent Threat (APT) actors, Indication of Compromise (IOC), Tactics, Techniques and Procedures (TTPs).

An Approach on Cyber Protection Changes by way of a cohesive Red and Blue Working Committee

An Approach on Cyber Protection Changes by way of a cohesive Red and Blue Working Committee