Cybersecurity Assurance Research Articles

Key drivers of cybersecurity audit effectiveness: A neo‐institutional perspective

The aim of this paper is to analyse which factors explain the effectiveness of internal audit in providing assurance about cybersecurity risk management. On the basis of neo‐institutional theory, we hypothesize that coercive (cybersecurity regulation), normative (professionalization of internal auditors and Boards) and mimetic forces (outsourcing of cyber security assurance services) positively contribute to cybersecurity audit (CSA) effectiveness. As these forces do not come about in an interest free model, we study the role of and the interaction with other actors who shape the CSA practices—Boards and security experts. We hypothesize that Board's support to CSA and the level of internal auditors' cooperation with the first and the second line of defence positively affect CSA effectiveness. To test our hypothesis, we conducted a survey involving IT auditors and Chief Audit Executives from various industries, organizations of different sizes and countries. We examined the hypothesized relationships in a series of regression analyses. We find that normative forces (professionalization of the internal auditors and Boards' competences), Board's support to CSA and cooperation between the internal audit function (IAF) and the first two line of defence significantly explain the CSA effectiveness. We find no support for the effect of regulation as a coercive force and outsourcing as a mimetic force. We discuss potential reasons for our findings and their implications. The paper is an original analysis that advances our understanding of key drivers of CSA effectiveness and their relationships.

The Impact of the Type of Cybersecurity Assurance Service and Cybersecurity Incidents on Investor Perceptions and Decisions

SUMMARY Regulators, investors, and boards of directors are increasingly demanding information about organizations’ cybersecurity risk management. I examine the effect of the AICPA’s voluntary cybersecurity examination service on investor perceptions and decisions. Similar to a previous AICPA IT-related assurance service called WebTrust that failed in the marketplace, cybersecurity examinations face competition from less comprehensive and less costly assurance services in a nonstandardized assurance market, and it is unclear whether investors will recognize the value provided by the more comprehensive assurance service. I find that investors are more willing to invest when management disclosures describe a cybersecurity examination compared with a less comprehensive assurance service but only if the assurance is in response to a cybersecurity incident. I also find that this effect is mediated by investor perceptions of assurance quality. I, however, do not find support for these same effects when the assurance is disclosed in the absence of an incident.

The impacts of the cyber-trust program on the cybersecurity maturity of government entities in the Kingdom of Bahrain

PurposeThis study aims to determine the impacts of the Bahrain Government framework [cyber-trust program (CTP)] on the cybersecurity maturity of government entities and how the CTP can impact the cybersecurity of government entities in the Kingdom of Bahrain.Design/methodology/approachThe authors used a quantitative and qualitative approach. The data were collected by conducting semi-structured interviews with the information technology experts in the Bahrain Government entities participating in the CTP. Also, quantitative data was obtained through a questionnaire distributed to relevant people in the information technology field.FindingsThe findings of this study suggest that the CTP had a significant impact on the cybersecurity assurance of the government entities that participated in the CTP; it increased the employees’ awareness, reduced the number of cyberattacks and optimized the available resources. The findings also highlighted the role of top management in the success of the implementation of the CTP. The results also ensure that the CTP’s maturity model affected the cybersecurity compliance of an organization and the implementation of cybersecurity policies and controls.Practical implicationsThis study enhances cybersecurity researchers’ and practitioners’ understanding of the impact of the CTP and its components and evaluates its influence on Bahrain’s cybersecurity assurance.Originality/valueThis study implies that to achieve better cybersecurity, managers should focus on implementing the policies and controls provided by cybersecurity frameworks to enhance cybersecurity assurance.

Decentralized Finance (DeFi) and Cybersecurity Assurance

Decentralized Finance (DeFi) and Cybersecurity Assurance

Cybersecurity Assurance System in the New Era and Development Suggestions Thereof: From Self-Defense to Guard

Cybersecurity Assurance System in the New Era and Development Suggestions Thereof: From Self-Defense to Guard

Characterising assurance: scepticism and mistrust in cyber security

ABSTRACT This paper presents an analysis of recent transformations in cyber security assurance, a field of evaluation that aims to establish whether technical products are secure. I work from a set of narratives about problems with assurance, drawn from interviews with practitioners based in the UK. I focus on characterisation: the stories practitioners tell, the cast of characters that populate them, and how such stories act to problematise the domain. Mistrust, it is argued, can be understood in terms of the capacities of sceptical narratives to efface the power of security certifications to be taken on ‘face value.’ A text-based view of mistrust is thus developed that can be differentiated from the conventional disposition-centred view. Examining mistrust, then, leads us to ask not how to change dispositions to make them ‘more trusting,’ but rather to critical questions about the palette of characters that feature in cyber security. I close the essay by offering a commentary on the way characterisation leads to the anticipation of experts in formulations of policy and on the possible ‘counter-characterisation’ that might be developed, for instance around ‘caring’ characters.

A detection method for cyber-attack on connected signal phase and timing information

This paper proposes a method to detect cyber-attacks by cross-checking Signal Phase and Timing (SPaT) information and connected vehicle trajectories data. The proposed method is only applicable to cyber-attacks that involve information tempering. The proposed V2I cyber-attacks detection algorithm includes the following features: i) effective in detecting the authenticity of broad-casted SPaT information; ii) feasible to identify the occurrence of cyber-attacks when the defensive function fails; iii) functional in the environment of partially connected and automated traffic; iv) leveraging transportation knowledge for cybersecurity assurance. Furthermore, a sensitivity analysis on the connected vehicle penetration rate is conducted. The best performance is observed when the penetration rate is 100%. Under this penetration rate, the experimental result demonstrates that the accuracy rate of the proposed method reached 94%.

Explainable AI-infused ultrasonic inspection for internal defect detection

While AI and imaging technologies are dramatically transforming the process and machine condition monitoring, product inspection remains confined to probing the geometry and surface morphology. Subsurface and bulk inspection remain prohibitively slow and imprecise. This paper presents an explainable AI (XAI)-infused ultrasound imaging approach for rapid detection of artifacts including product defects. The approach led to the discovery of correlated spatial patterns in the images located away from the artifacts. This discovery enabled accurate (> 80%) detection of artifacts that are not discernible with the current image segmentation methods, and it could profoundly impact product quality and (cyber)security assurance technologies.

Cybersecurity Assurance Program by the U.S.Accounting Firms and its Implications: Focusing on the AICPA SOC Assurance Programs

Cybersecurity Assurance Program by the U.S.Accounting Firms and its Implications: Focusing on the AICPA SOC Assurance Programs

Cybersecurity Assurance in the Emerging Manufacturing-as-a-Service (MaaS) Paradigm: A Lesson from the Video Streaming Industry

Abstract The coronavirus disease 2019 outbreak has incapacitated physical supply chains of various industrial sectors. This has been a call for attention to rethinking innovative methods to improve supply chain resilience. Emerging manufacturing technologies like additive/hybrid manufacturing are enabling small and medium enterprises (SMEs) to transform into cybermanufacturing kiosks that deliver manufacturing-as-a-service by digitizing much of the manufacturing workflow (design, communication, and manufacturing). This transformation is causing a paradigm shift in which major producers and original equipment manufacturers can outsource manufacturing of components to distributed SMEs located near the point of need. The increasing reliance on a digital thread would reduce the burden of resiliency required from the physical supply chains. Although digital threads are reducing the burden on the physical supply chains, they introduce a new class of cyber-resilience requirements, chiefly in ensuring the integrity of the designs and other intellectual properties shared across the digital thread. A novel design-sharing scheme for the digital thread based on video streaming is introduced herein to address the issue of IP theft and tampering. The potential of design-sharing schemes for the improvement of the cyberresilience of digital supply chains is discussed.

How Effective Is Cyber Security Assurance by Internal Auditors?

The aim of this paper is to analyze how effective internal audit of cybersecurity is. We developed a Cybersecurity Audit Index composed of three dimensions (planning, performing and reporting) to address this question. We hypothesize that CSA effectiveness is positively related to cyber risk management maturity and negatively to the probability of a successful cyber attack. We tested our hypotheses in a survey with auditors and Chief Audit Executives from various countries and industries. We found that CSA Index scores significantly vary, with a mean of 58 on a scale from 0 to 100. While planning and performing CSA are strongly and positively correlated, they are less strongly related to reporting about CS risk management effectiveness to the Board of Directors. In line with our hypothesis, the CSA Index is positively associated with CS risk maturity, but contrary to our hypothesis, it is not related to the probability of a cyber attack. This is the first paper that comprehensively measures the effectiveness of cybersecurity audit and its effects on CS risk management.

Country-level cybersecurity posture assessment:Study and analysis of practices

ABSTRACT Along with positive impacts, ICT transformation also increases the exposure of critical infrastructure to cyber-attacks. Keeping in view the constantly evolving cyber-threat landscape, it is vital for a country to continuously assure the cybersecurity of its ICT infrastructure. Recently the security of the cyberspace has got a much-needed emphasis from Governments and International Agencies. To generate assurance, actions initiated by a country to counter cyber threats need to be continuously assessed for implementation & effectiveness. This study aims to offer a new perspective on country-wide cybersecurity benchmarking and assurance. The paper presents the study and analysis of the methods and practices adopted by countries for cybersecurity posture assessment and generating assurance on the implemented cybersecurity measures. In this paper, the cybersecurity posture assessment and assurance practices implemented by 37 countries are studied with an objective of understanding the global scenario and identification of different methods adopted for a cybersecurity posture assessment.

Core‐level cybersecurity assurance using cloud‐based adaptive machine learning techniques for manufacturing industry

AbstractCybersecurity is the domain that ensures safeness in both individual system and overall network systems. The classification and learning approaches used in different machine learning (ML) techniques improve the protection of the cyber systems against various attacks. Techniques such as support vector machine (SVM), neural networks (NN), principle component analysis (PCA), and reinforcement learning (RL) are used against various cyber threats. Applying these techniques at the front‐end services (either online or offline) makes less effect than back end process‐level services of any computer system. The proposed work analyzes the benefits of implementing customized ML and deep learning (DL) techniques on the core of the operating system than application level services, which in effect increases the speed and correctness of attack detection. The core (kernel) of the operating system has the capability to extract all internal attributes of process and file systems. The kernel space security activities can be improved by proposed work where the process level attributes classified using ML and DL techniques. The cloud service helps in sharing of the kernel abilities of the system ensuring core level security. The following work uses recurrent NN (RNN), SVM, PCA, and RL for analyzing the system data collected using Process Explorer. This technique finds application in manufacturing domain where the systems are protected from the various attacks to secure the data of the manufacturing company.

New Complementary Points of Cyber Security Schemes for Critical Digital Assets at Nuclear Power Plants

As the importance of cyber security for nuclear power plants has recently increased, related organizations such as manufactures, operators, regulators, and research institutes have taken into consideration the many concerns for effective application of cyber security to critical digital assets at nuclear power plants. It is essential to analyze and research how to effectively apply nuclear cyber security requirements and what complementary factors are present in the overall process for a nuclear security technology system. The complementary points of nuclear cyber security technology could be analyzed through diverse cyber security methods such as cyber security assurance, assessments, and software development life cycle. It is necessary to apply nuclear cyber security technology effectively in accordance with the operation, assurance, and system development process of a nuclear facility. These analysis results could be applied to technical points for the cyber security of critical digital assets at nuclear power plants in the future and to technology that needs to be at the appropriate level of cyber security to ensure technical assurance. This paper is a new approach to compare and analyze various methods used in the cyber security field to discover complementary points for the application of cyber security to critical systems in nuclear power plants. Additionally, this paper also presents effective methods for developing and applying, evaluating, and regulating cyber security in nuclear digital critical systems using the complementary points of various cyber security methods identified in the analysis.

Cyber security assurance process from the internal audit perspective

PurposeThe purpose of this study is to analyze the cybersecurity assurance approaches to determine the key issues and weaknesses within the internal audit and risk management perspective. Organizations increasingly rely on digital data to drive their growth and they are interconnected in a complex web to a multitude of stakeholders.Design/methodology/approachIn this paper, cybersecurity is defined, and cybersecurity assurance model is explained based on the relevant literature. In addition, the role of internal auditing is introduced within this new business landscape. Finally, recommendations are made to provide best practices for stakeholders.FindingsThere are four major cyber-focused standards and frameworks in the current literature, namely, Control Objectives for Information and Related Technology, International Organization for Standardization, The American Institute of Certified Public Accountants and National Institute of Standards and Technology. In addition, there are many mechanisms in existence and operation currently which support cybersecurity assurance to prevent major threats. These include risk assessment, risk treatment, risk management, security assurance and auditing.Research limitations/implicationsCyber risk is not something that can be avoided; instead, it must be managed. Hence, it is very important to maintain formal documentation on related cyber controls. Internal audit should be an integral part of cybersecurity assurance process, as internal audit have a unique position to look across organizations. The contribution of internal audit also provides comfort to the Board and Audit Committee.Practical implicationsA model is introduced how the internal audit and information security functions could work together to support organizations accomplish a cost-effective level of information security. The key issues and approaches are explained for how to become a trusted cybersecurity advisor and a sample cybersecurity awareness program checklist is provided at Appendix 1.Social implicationsConsidering cybersecurity threats grow with speed, complexity, and impact, organizations are no longer satisfied with an answer to a question like “are we secure?” instead, they need the answer for such a question like “how to give a reasonable assurance that our business will be secure enough?”. In that respect, the role of internal audit is discussed based on the relevant literature and the current condition of the business environment.Originality/valueA model is introduced how the internal audit and information security functions could work together to support organizations accomplish a cost-effective level of information security. The key issues and approaches are explained for how to become a trusted cybersecurity advisor and a sample cybersecurity awareness program checklist is provided at Appendix 1.

Bridging Networks, Systems and Controls Frameworks for Cybersecurity Curricula & Standards Development

Applied Cybersecurity practices in the US private and public industry are transitioning to an overall focus on Cyber Risk Management. It is hence necessary to align IT-Cybersecurity professional association application standards and related educational curricula with emerging applications in practice. Current standards and educational curricula seem fragmented across Networks Protocols and Network Analysis Tools Frameworks, Systems and Networks Infrastructure Frameworks, and, Risk Management & Controls Policy Frameworks. This article develops an applied framework for aligning, integrating, and, streamlining standards and curricula across the above three levels to align them with needs of applied Risk Management practice. The Cyber Risk Management framework is developed with focus on VoIP networks which have been gaining central prominence across diverse industries such as global Banking and Finance over the past decade. Despite central role technologically and economically, sparse attention has been given to critical vulnerabilities described as the ‘weakest links’ in global Banking and Finance networks as evident from Cybersecurity and Penetration Testing. This article demonstrates the contribution of the proposed Cyber Risk Management framework in addressing such critical gaps in global Banking and Finance Cybersecurity and Information Assurance practices as an example while being extendable to multiple other industries such as Healthcare.

Human behaviour as an aspect of cybersecurity assurance

AbstractThere continue to be numerous breaches publicised pertaining to cybersecurity despite security practices being applied within industry for many years. This paper is intended to be the first in a number of papers as research into cybersecurity assurance processes. This paper is compiled based on current research related to cybersecurity assurance and the impact of the human element on it. The objective of this work is to identify elements of cybersecurity that would benefit from further research and development based on the literature review findings. The results outlined in this paper present a need for the cybersecurity field to look in to established industry areas to benefit from effective practices such as human reliability assessment, along with improved methods of validation such as statistical quality control in order to obtain true assurance. The paper proposes the development of a framework that will be based upon defined and repeatable quantification, specifically relating to the range of human aspect tasks that provide or are intended not to negatively affect cybersecurity assurance. Copyright © 2016 John Wiley & Sons, Ltd.