Cyber Risk Management Research Articles

Cyber risk logics and their implications for cybersecurity

Abstract Cybersecurity in national and international security is frequently discussed in an existential register. However, most cybersecurity activities are normal and routine, including diverse practices of cyber risk management. The intricacies of cyber risk and its connection to security and threat politics have received surprisingly little attention in the cyber politics literature. This article addresses this gap through a twofold theoretical proposition. The first argues that cyber risk in policy and practice inhabits a continuum between ‘classical’ risk and security postures. The second proposes the existence of multiple risk logics, located at different points along this continuum. To illustrate this, we outline two distinct cyber risk logics: ‘risk as potential threats’ and ‘risk as uncertainty’. Through an exploratory case-study of cyber risk policy and guidance in the United Kingdom, we find indications of the simultaneous existence of these risk logics, including in specific organizational contexts. We propose that the ‘risk as potential threats’ logic, in particular, acts as a ‘bridge’ between conventional risk and security. We conclude by discussing how differentiating cyber risk logics facilitates a more finely grained appreciation of cybersecurity policy and practice and provides opportunities for disciplinary engagement with the organizational and institutional politics of cybersecurity and ‘the international’.

Cyber risk management technology to strengthen the information security of the national economy

Purpose. Developing a technology for managing cyber risks based on their improved classification by the level of impact on the occurrence of an extreme situation. Methodology. To achieve the goal, general scientific and special methods of cognition were used in the study: dialectical and systemic approaches, analysis and synthesis, logical generalization and grouping, structural-logical method, iterative approach, modeling, method of formal representations of uncertainty. Findings. A cyber risk management technology has been developed, consisting of four main stages: analysis of cyber threats (context establishment; security audit; formation of scenario concepts); scenario modeling (threat decomposition; scenario formation; setting criteria; setting probability estimates of concepts (variables); building a network architecture; formation of a private threat model; scenario analysis); risk assessment; object classification. The proposed approach to cybersecurity risk management provides vulnerability detection and risk assessment (risk potential) and simplifies the development of management solutions to prevent events affecting cybersecurity. Originality. The proposed technology differs from the existing ones by focusing on identifying those vulnerabilities and cyber threats that, according to their improved classification by the level of impact on the occurrence of an extreme situation, can lead to serious disruptions in the functioning of critical information infrastructure of the national economy. Practical value. The practical significance of the study lies in the fact that the proposed cyber risk management technology is one of the tools for preventing the realization of risks in cyberspace and the basis for strengthening the information security of economic entities in particular and the national economy as a whole.

دراسة تطبيقية عن دور إدارة المخاطر في تعزيز الأمن السيبراني للمؤسسات الصغيرة والمتوسطة في المملكة العربية السعودية

This study aimed to evaluate and improve cyber risk management in small and medium enterprises in the Kingdom of Saudi Arabia. The study relied on the descriptive, analytical and inductive approach, using data collection tools such as questionnaires, interviews and case studies. The most prominent results were weak level of use of information technology among 50% of employees. Shipping and delivery procedures policy is the most used at 33%. Antivirus software is the most used security technology at 40%. Fake audio and video attacks represent the biggest obstacle to cyber risk management at 30%. 50% of employees are aware of cyber risks. There is a strong correlation (89%) between employee awareness and cyber risk management. Key recommendations include raising awareness, developing comprehensive policies, conducting periodic risk assessments, investing in modern technologies, building a strong security culture, and providing qualified human resources.

Organisational cyber resilience: a heuristic for bridging foundations and applications

PurposeThe drive for digitalisation has increased the scope of cyber threats which can exploit the growing footprint of information and communication technology infrastructure supporting modern societies. Despite substantial interest and efforts in researching and building organisational cyber resilience, the resulting body of work is heterogeneous and has yet to reach maturity. This paper aims to address the gap in the conceptualisation of cyber resilience in academic and practice-oriented grey literature.Design/methodology/approachIn this conceptual paper, we firstly seek to explore the available foundations of resilience as a construct and consider how these can be applied to organisational cybersecurity. To that aim, this study employs a targeted literature review approach, incorporating systematic elements to ensure rigour. Literature was identified through comprehensive searches in key academic databases, reference chaining and expert recommendations. Articles were selected based on relevance and contribution to the field, resulting in a thematic analysis to identify gaps and propose a heuristic model for cyber resilience. With this approach, we aim to position the emerging view of cyber resilience relative to risk analysis, while highlighting its domain of “conceptual comparative advantage” – the types of applications it is best suited to address. Finally, a high-level heuristic model for cyber resilience is proposed, which functions across the relevant policy, strategy and operational dimensions while also considering its relationship with cyber risk management.FindingsA conceptual model for organisational cyber resilience is proposed which helps position and frame research contributions in this domain relative to risk analysis, highlighting its domain of comparative advantage. The model integrates policy, strategy and operational dimensions, in a manner conducive to bridging foundations and applications of the concept of cyber risk management. The proposed model provides a critical point of reference to evaluate individual models, frameworks and tools.Originality/valueThis paper is a pioneering effort to overcome the current gaps between conceptual and practical views of cyber resilience. It proposes a new, risk-aligned view of the concept of cyber resilience and provides a structural foundation for further research and practice in the field.

Minimizing Business Disruption During Enterprise End-Point OS Upgrade while Maintaining a Robust Security Posture

The deployment of a major end-point operating system (OS) upgrade presents significant challenges for enterprise organizations, requiring a comprehensive strategy to minimize business disruption and maintain a robust security posture. Beyond the operational complexities of managing user productivity and application compatibility, organizations must also proactively address the critical security risks associated with such large-scale technology transitions. Cybercriminals often target organizations undergoing major IT changes, seeking to exploit vulnerabilities that may arise due to shifts in the OS architecture, user workflows, and security controls. This paper outlines practical strategies for executing successful OS upgrade projects that balance operational resilience and cyber risk management. Key focus areas include proactive management of end-point security, comprehensive contingency planning and rollback procedures, strategies to sustain productivity and business continuity, effective end-user training and communication, and valuable insights into the next- generation OS deployment. By focusing on these critical aspects, organizations can navigate major OS upgrade initiatives while preserving vigorous business operations, enhancing end-user experience, and safeguarding sensitive data and systems from costly security incidents.

Why Probabilities Cannot Be Used in Cyber Risk Management

Why Probabilities Cannot Be Used in Cyber Risk Management

An evaluation of cyber-worthiness and related factors in maritime safety and maritime security

ABSTRACT This article revisits the traditional definition and concept of seaworthiness against the backdrop of technological developments in maritime transport and maritime law. These developments in the maritime industry, coupled with the increasing volume of maritime commerce, have affected the traditional doctrine of seaworthiness and necessitate its redefinition. Of the many developments, this article focuses on maritime security generally and cyber-risk and hence cyber-worthiness in particular. The article argues that cyber risk management, as a part of maritime safety and security standards, should be reflected in the modern doctrine of seaworthiness. It is problematic to provide a generally acceptable uniform definition for seaworthiness in maritime law, because the concept is both relative and technical. Furthermore, and considering the components of a seaworthy ship, the need to assess new systems related to technology used in ships and safety in navigation, and to determine whether a ship can be deemed “cyber-secure” has become essential.

An investigation of ransomware incidents in the maritime industry: Exploring the key risk factors

Ransomware is a subset of malicious cyberattacks that aim to hold an organization’s data or critical infrastructure at ransom, compromising or blocking access. If the attack is public or made public after the initial attack, it can also severely jeopardize an organization’s reputation. Given the direct and immediate impact ransomware attacks can have and the lack of in-depth sharing, additional research is needed to analyze ransomware incidents in order to understand the underlying causes of incidents in addition to the detection and prevention methods. In this paper, 22 public ransomware incidents within the marine industry have been investigated to determine their causal factors and commonalities. To investigate causal factors, DEMATEL (Decision Making Trial and Evaluation Laboratory) and a fuzzy set are used in order to enable an organization to better adhere to operational requirements and cyber risk management strategies to increase cyber resilience against ransomware incidents. The study’s findings highlight the fact that network layer cyber security mitigations, strategies for securely utilizing RDP (Remote Desktop Protocol) protocols, and investments in operating systems (OS) and software security are essential components of preventing future ransomware incidents. This study concludes by suggesting several suitable control and preventative measures to improve system safety.

Improving cyber risk governance through storytelling

This paper addresses the critical challenge of cyber risk governance faced by executives, security committees and boards of directors in the rapidly changing digital landscape. Cyber security complexity, characterised by data deluges and the translational gap between technical jargon and business risk, significantly hinders effective cyber risk messaging and governance. Drawing on five years of research and interviews with chief information security officers (CISOs), the paper highlights the struggle in establishing trust and confidence in governance bodies due to these complexities. It introduces three constructs that aim to simplify cyber security messaging to enhance cyber risk governance: the intelligence to risk (I2R) pyramid, five risk impacts, and resilience and proximity graph. Each construct, illustrated with practical examples, is designed to provide clarity and foster understanding between cyber security professionals and governance bodies, ensuring a cohesive approach to cyber risk management. Readers can expect to gain valuable insights into overcoming the limitations of traditional risk communication tools such as risk registers. By adopting the presented storytelling approach, the paper promises strategies for building trust through transparency and accountability, bridging the communication gap between technical and executive levels, and facilitating informed decision making for improved governance outcomes in the face of cyber security threats.

Cyber-Risk Management Menggunakan NIST Cyber Security Framework (CSF) dan Cobit 2019 pada Instansi XYZ

Current technological developments trigger companies or organizations to use Information Technology (IT) as a service base and optimize business processes. IT can provide opportunities in the government sector to develop state apparatus through implementing the Electronic-Based Government System (SPBE). Central and Local Government Agencies have implemented SPBE and contributed to the efficiency and effectiveness of government administration. Ensuring the sustainability of SPBE and reducing the impact of risk is the goal of risk management, with a process of identification, analysis, control, monitoring, and evaluation of risks based on risk management determined by the government. XYZ Agency is an agency that operates in the fields of communication and information, coding and statistics. XYZ Agency also implemented an Electronic Based Government System (SPBE). In this study, Cyber-risk management was designed using NIST CSF and COBIT 2019. In designing cyber-risk management, using 6 stages, namely Prioritized and Scope, Orient, Create a Current Profile, Conduct Risk Assessment, Create a Target Profile, and Determine, Analyze, and Prioritize Gaps. In this study, there are 28 assets, 17 threats, 13 vulnerabilities, and 12 controls implemented. With these results obtained 111 risks, there are 35 risks in the high category, 63 risks in the medium category, and 13 risks in the low category. The final result of this research is the preparation preparation of a cyber-risk management design by grouping the recommended actions based on Work Products (WP) and Generic Work Products (GWP) which become a work program for XYZ Agency.

Tinjauan Literatur Manajemen Risiko Cyber dalam Proyek: Identifikasi, Evaluasi, dan Mitigasi Ancaman

In today's digital era, business projects are increasingly vulnerable to cyber threats, which can result in significant financial and reputational losses. This journal discusses an effective cyber risk management approach for projects, encompassing the identification, evaluation, and mitigation of digital threats. The objective is to provide an overview of risk management in projects. This journal explains how to identify risks by thoroughly analyzing various potential cyber threats, such as malware, phishing, and DDoS attacks that could impact the project. Subsequently, risk evaluation is conducted by assessing the vulnerability and potential impact of each identified threat, using a literature review method. The literature review includes the analysis of data obtained from relevant articles and books on the topic. The final stage involves risk mitigation, which includes developing strategies to reduce or eliminate the impact of threats, such as implementing security controls, providing employee education and training, and developing incident response plans. This study emphasizes the importance of a proactive and holistic approach to cyber risk management to ensure the success and sustainability of projects. The journal aims to provide an overview of risk management in projects, demonstrating that the integration of comprehensive cyber risk management practices can significantly enhance the resilience of projects against digital threats.

Towards Diagnosing and Mitigating Behavioral Cyber Risks

A company’s cyber defenses are based on a secure infrastructure and risk-aware behavior by employees. With rising cyber threats and normative training efforts showing limited impact, raising cyber risk awareness is emerging as a challenging effort. The review of the extant literature on awareness diagnosis shows interdisciplinary but mainly theoretical approaches to understanding attitudes and influencing risk behavior. We propose and test a novel methodology to combine and operationalize two tools, deep metaphor interviews and the IDEA risk communication model, to apply them for the first time in the context of behavioral cyber vulnerabilities. The results show a link between diagnosed attitudes and effective risk behavior in a real-life organizational setting, indicating the potential for an expanded diagnostic effort. We propose to develop a broader diagnostic and intervention set to improve cyber awareness and a toolkit to support the business practice of cyber risk management.

Optimism bias and its impact on cyber risk management decisions

This study explores how optimism bias influences decision-making in cyber risk management by developing a novel model that reflects utility loss aversion, a factor previously unexplored in this context. We find that decision-makers with self-protection as reference point are less likely to invest in other cyber risk management measures, providing support for optimism bias observed in the cyber-insurance market. We also show that decision-makers with higher loss aversion tend to not invest in other cyber risk management measures. Our results help to explain the lack of demand for cyber-insurance and have important implications for corporate risk management and public policy on cyber risk. They also help better understand cyber risk events which can trigger huge systemic consequences for economies and societies.

Financial Technology as a Tool for Promoting Financial Inclusion in Nigeria

Financial technology (FinTech) as a concept and practice, started gaining serious worldwide traction following the outbreak of the global financial crisis in 2008. Thus, this paper is undertaken to critically discuss the emerging trends in financial technology and how they enhance financial inclusion, as well as the problems faced by financial technology in financial inclusion, with a specific focus on Nigeria. The paper adopts the exploratory qualitative research approach, using secondary data sources involving an extensive review of recent articles, periodicals, empirical and analytical studies, policy discussions, working papers, and other documented materials found to be pertinent to the study. The paper reveals that over the last decade, Fintech’s contribution to financial inclusion in Nigeria has exploded. FinTech has improved the usual way of rendering financial services and has created new inventions that have made financial activities not only more accessible but also faster, thereby easing the lives of financial service users in Nigeria, where mobile network technology is powering financial inclusion and bringing more people into the financial system. Despite the contributions of FinTech to financial inclusion in Nigeria, the paper notes the issue of high level of attrition in customer patronization and the threat of Cyber-attacks as major challenges. Based on this therefore, the paper recommends the need for regulatory bodies to do more to bring synergy between the operating companies and their interactions with the customers and prospective consumers for proper sensitization about these fintech services, considering the disinterest of many due to distrust of the system. Furthermore, the paper recommends that regulatory bodies should develop a more effective framework for monitoring cyber risk management at financial institutions using technology and laws that will duly prosecute cyber criminals and serve as a deterrent to others.

An Integrated Approach to Cyber Risk Management with Cyber Threat Intelligence Framework to Secure Critical Infrastructure

Emerging cyber threats’ sophistication, impact, and complexity rapidly evolve, confronting organizations with demanding challenges. This severe escalation requires a deeper understanding of adversary dynamics to develop enhanced defensive strategies and capabilities. Cyber threat actors’ advanced techniques necessitate a proactive approach to managing organizations’ risks and safeguarding cyberspace. Cyber risk management is one of the most efficient measures to anticipate cyber threats. However, it often relies on organizations’ contexts and overlooks adversaries, their motives, capabilities, and tactics. A new cyber risk management framework incorporating emergent information about the dynamic threat landscape is needed to overcome these limitations and bridge the knowledge gap between adversaries and security practitioners. Such information is the product of a cyber threat intelligence process that proactively delivers knowledge about cyber threats to inform decision-making and strengthen defenses. In this paper, we overview risk management and threat intelligence frameworks. Then, we highlight the necessity of integrating cyber threat intelligence and assessment in cyber risk management. After that, we propose a novel risk management framework with integrated threat intelligence on top of EBIOS Risk Manager. Finally, we apply the proposed framework in the scope of a national telecommunications organization.

Cyber Risk Assessment Framework for the Construction Industry Using Machine Learning Techniques

Construction 4.0 integrates digital technologies that increase vulnerability to cyber threats. A dedicated cyber risk assessment framework is essential for proactive risk mitigation. However, existing studies on this subject within the construction sector are scarce, with most discussions still in the preliminary stages. This study introduces a cyber risk assessment framework that integrates machine learning techniques, pioneering a data-driven approach to quantitatively assess cyber risks while considering industry-specific vulnerabilities. The framework builds on over 20 literature reviews related to construction cybersecurity and semi-structured interviews with two industry experts, ensuring both rigor and alignment with practical industrial needs. This study also addresses the challenges of data collection and proposes potential solutions, such as a standardized data collection format with preset fields that computers can automatically populate using data from construction companies. Additionally, the framework proposes dynamic machine learning models that adjust based on new data, facilitating continuous risk monitoring tailored to industry needs. Furthermore, this study explores the potential of advanced language models in cybersecurity management, positioning them as intelligent cybersecurity consultants that provide answers to security inquiries. Overall, this study develops a conceptual machine learning framework aimed at creating a robust, off-the-shelf cyber risk management system for industry practitioners.

Cyber Risk in Insurance: A Quantum Modeling

In this research, we consider cyber risk in insurance using a quantum approach, with a focus on the differences between reported cyber claims and the number of cyber attacks that caused them. Unlike the traditional probabilistic approach, quantum modeling makes it possible to deal with non-commutative event paths. We investigate the classification of cyber claims according to different cyber risk behaviors to enable more precise analysis and management of cyber risks. Additionally, we examine how historical cyber claims can be utilized through the application of copula functions for dependent insurance claims. We also discuss classification, likelihood estimation, and risk-loss calculation within the context of dependent insurance claim data.

Cyber Threat Analysis (CTA) in Current Conflicts

Cyber Threat Analysis (CTA) in current conflicts focuses on identifying, monitoring, and assessing potential cyber threats. The main objective is to understand how the parties to the conflict use information and network technologies to conduct warfare, espionage, disinformation, or attacks on digital infrastructure. This analysis includes the identification of actors involved in conflicts and their targets in cyberspace, as well as the analysis of techniques and tools used in cyber activities. The aim of the article is to identify the role of cyber threat analysis in the context of two current conflicts - the war in Ukraine and the Hamas attack on Israel. The article describes the essence of cyber threat analysis. The research problem focuses on identifying and understanding the role of cyber threat analysis in these conflicts and their potential consequences for international security and regional stability. Through the analysis of reports, online sources, and scientific literature, the article aims to familiarize readers with the role of cyber threat analysis in the context of these conflicts and to propose possible strategies for cyber risk management in the face of contemporary armed conflicts. The results of the analysis of cyber threats (CTA) in current conflicts include the identification of specific actors operating in cyberspace, their modus operandi, their objectives, and the techniques and tools used. In addition, the analysis can reveal existing vulnerabilities in digital security and areas that are particularly vulnerable to attacks. To sum up, it is necessary to create recommendations and directions for changes regarding the strengthening of digital security measures, such as software updates, implementation of network security, and increasing staff awareness of cyber threats. In addition, the CTA may suggest the need for better international cooperation to combat cyber threats and the need to develop strategies to prevent and respond to cyber-attacks.

A lightweight framework for cyber risk management in Western Balkan higher education institutions.

Higher education institutions (HEIs) have a significant presence in cyberspace. Data breaches in academic institutions are becoming prevalent. Online platforms in HEIs are a new learning mode, particularly in the post-COVID era. Recent studies on information security indicate a substantial increase in cybersecurity attacks in HEIs, because of their decentralized e-learning structure and diversity of users. In Western Balkans, there is a notable absence of incident response plans in universities, colleges, and academic institutions. Moreover, e-learning management systems have been implemented without considering security. This study proposes a cybersecurity methodology called a lightweight framework with proactive controls to address these challenges. The framework aims to identify cybersecurity vulnerabilities in learning management systems in Western Balkan countries and suggest proactive controls based on a penetration test approach.

Cybersecurity and executive compensation: Can inside debt-induced risk aversion improve cyber risk management effectiveness?

This study contributes to the emerging literature on the determinants and the consequences of cyberattacks by examining the impact of inside debt compensation on a firm's likelihood of experiencing a cyberattack and on attacked firms' cash holdings, R&D investments, and asset tangibility. We provide compelling evidence that inside debt compensation reduces the probability of experiencing a cyberattack. Furthermore, we document that high inside debt CEOs reduce their firm's cash holdings while they increase R&D investments and asset tangibility once their firms experience a hacking incident. These effects persist for three years after the attack. Our results are robust to alternative measurements of inside debt compensation and after accounting for potential sample selection and endogeneity concerns. Our findings underscore the importance of inside debt compensation as a governance mechanism that alleviates inefficiencies related to cybersecurity investments.