Cybersecurity Incidents Research Articles

A Survey on National Cyber Emergency Plans

Operators of Essential services (OESs) and Critical infrastructures (CIs), whether private companies or public organizations are going through a digital transformation to pace with the evolution of technology and to bring better services to customers and countries’ citizens. Operational Technology (OT) systems like Supervisory Control and Data Acquisition (SCADA) and Distributed Control Systems (DCS) used to control and monitor functions in such infrastructures are converging with Information Technology (IT) environments. This convergence has exposed infrastructures to new cyber risks. For this reason, EU Member States have been trying to build resilience against cyber-attacks to ensure the stable operation of their states. Several countries have established cybersecurity incident response procedures as well as steps or phases of response before, during, and after a cyber incident. The sum of these procedures and guidelines constitutes their national cyber emergency plans (NCEPs). Still, these NCEPs differ widely in their approaches. These differences manifest as both managerial, governmental, legal, and technical, creating a complex environment worldwide. In this paper, we gather four major NCEPs worldwide to analyze and compare them with prominent standards and industry guidelines in cybersecurity, like the ISO 27001 and NIST 800 series. We investigate NCEP approaches to building cyber resilience based on their response models, their involved entities, the cooperation between agencies and other countries, and their risk-based categorization for cyber incidents. We elaborate on their differences, potential issues and divergences and argue whether these plans can be combined to bridge potential weaknesses. We selected and surveyed four (4) cyber emergency plans from four (4) countries that are frequent targets of cyber-attacks and have long experience in managing and responding to cyber incidents.

Cybersecurity Insights Gleaned from World Religions

Organisations craft and disseminate security policies, encoding the actions they want employees to take to preserve and protect organisational information resources. They engage in regular cybersecurity awareness and training drives to ensure that employees know what to do, and how to do it. Despite these efforts, employees make mistakes or do not comply with policy dictates, triggering cybersecurity incidents. The reality is that whereas cyber professionals propose, human nature disposes.In addressing this kind of conundrum, researchers suggest that it could be beneficial to learn from the established practices of other domains that also grapple with erratic human behaviours. This seems reasonable, given that cybersecurity is a relatively young field, and not yet particularly successful in accommodating human nature and fallibility, whereas other fields have years of experience coping with these kinds of problems. Here, we consider learning from religions, which have been around for millennia. The one aspect that all understand is human nature, and the tendency of humans to make mistakes and behave ill-advisedly, sometimes despite knowing better. Religions have developed a number of practices to accommodate human frailties, and to care for their adherents. This might well be a fruitful domain for cybersecurity professionals to learn from, in terms of harnessing effective mechanisms to encourage secure behaviours.To this end, we explored the literature on religions, and interviewed a number of religious leaders to produce a ‘vision for cybersecurity’. The vision was evaluated by cybersecurity professionals, its target audience. We provide our vision here, in the hope that it will launch a debate into a more equitable new era of ‘best practice’ in the cybersecurity domain.

An actionable maturity planning model for smart, circular cities

In this paper, we propose a macroeconomics approach to assist decision-makers and stakeholders when considering the transition of a city towards the circular economy paradigm. We reflect on approaches that leverage smart city maturity models to capture the evolution and trajectory of a city in its quest for smartness. By adopting the cross-methodology borrowed from the macroeconomics domain, we illustrate how a maturity model can be actionable in the sense that it can reveal the equilibria of supply and demand of a given smart city dimension or parameter. To evaluate this methodology, we study a well-known use case in cybersecurity, specifically incident response, against crowdsourcing, a key enabler of a data-driven circular economy. Our findings confirm that when crowdsourcing is injected into smart city infrastructure, the city's maturity is expected to increase as the additional capabilities can contribute to addressing cybersecurity incidents.

Cybersecurity incident reporting laws in the Asia Pacific

Cybersecurity incident reporting laws in the Asia Pacific

Methodologies for Predicting Cybersecurity Incidents

Data science may be used to detect, prevent, and address ever-evolving cybersecurity risks. CSDS is a fast developing field. When it comes to cybersecurity, CSDS emphasises the use of data, concentrates on generating warnings that are specific to a particular threat and uses inferential methods to categorise user behaviour in the process of attempting to enhance cybersecurity operations. Data science is at the heart of recent developments in cybersecurity technology and operations. Automation and intelligence in security systems are only possible through the extraction of patterns and insights from cybersecurity data, as well as the creation of data-driven models that reflect those patterns and insights An attempt is made in this work to describe the various data-driven research approaches with a focus on security. In accordance with the phases of the technique, each work that anticipates cyber-incidents is thoroughly investigated to create an automated and intelligent security system.

Learning from cyber security incidents: A systematic review and future research agenda

Cyber security incidents are now prevalent in many organisations. Arguably, those who can learn from security incidents and address the underlying causes will reduce the prevalence of similar ones in the future. This research provides a new examination of how organisations learn from incidents by systematically reviewing academic research on organisational learning from cyber security incidents and identifying further research needed in this area. To do this, it considers three research questions: what research has been conducted on learning from cyber security incidents, what learning practices in organisations have been found by research and what improvements have been recommended, and what further research is needed as organisations learn from such incidents. Using the PRISMA method, a total of 3,986 articles were extracted and, from these, a relevant set of 30 were selected for analysis to map the body of research, and to identify future research avenues. Despite learning lessons being recommended by both researchers and industry standards, our findings suggest that this advice is not being fully adopted by organisations. Importantly, these studies have found inadequate participation in learning activities, with superficial causal investigations, scarce effort on ensuring lessons are implemented and no evaluation of whether the actions taken actually reduce future security incidents. More research is needed to understand the right level and which learning practices to invest in for the greatest impact. For practitioners, this review discusses the essential elements of an effective process to learn from incidents. This review provides academics with a novel synthesis of the research undertaken on this topic, enabling them to incorporate the significant findings into their work and potentially explore the research agenda suggested.

A Comparative Study of Cybersecurity Laws in India and Other Countries

Cybersecurity laws are essential in protecting individuals and organization from cyber threats, but they can very significantly from country to country. In this comparative study, we examine the cybersecurity laws in India and other countries, including Japan, Germany and Australia. We compare and contrast the legal framework of each country, focusing on areas such as data privacy, cybersecurity incident reporting, and regulatory enforcement. Thought this analysis, we aim to identify the strength and weakness of each country‟s cybersecurity laws and provide insights into how India could improve its legal framework. This research will be useful for policymakers, legal professionals, and cybersecurity experts who are interested in understanding the global landscape of cybersecurity laws and hoe they can be applied in the Indian context.

Healthcare Cybersecurity Threat Context and Mitigation Opportunities

With the rapid increase in cybersecurity incidents around the globe, no business or industry is hidden from cybercriminals' crosshairs. Cyber-attacks are evolving and becoming more complex each day, causing much damage to different financial and reputational sectors. The health sector (including healthcare technology) is increasingly digitized and continues to offer life-critical services. It continues to improve diagnosis, treatment, and patient care with state-of-the-art technologies. However, cybercriminals continue to exploit vulnerabilities and exfiltrate confidential patient data and other confidential information. The health care sector offers cybercriminals a rich source of confidential data and is very easy to exploit as the defense and security controls are weak. Because of the growing number of threats associated with the health sector, it is essential to understand how health care practitioners - along with concerned critical Information Technology (IT) teams - can take steps to improve the cybersecurity posture of this industry and help reduce the attack surface. Hence, this paper discusses a critical approach to analyze the current cybersecurity challenges faced by the health care sector and relevant mitigation and other scholarly articles and research papers.

Values and Value Conflicts in the Context of OSINT Technologies for Cybersecurity Incident Response: A Value Sensitive Design Perspective

The negotiation of stakeholder values as a collaborative process throughout technology development has been studied extensively within the fields of Computer Supported Cooperative Work and Human-Computer Interaction. Despite their increasing significance for cybersecurity incident response, there is a gap in research on values of importance to the design of open-source intelligence (OSINT) technologies for this purpose. In this paper, we investigate which values and value conflicts emerge due to the application and development of machine learning (ML) based OSINT technologies to assist cyber security incident response operators. For this purpose, we employ a triangulation of methods, consisting of a systematic survey of the technical literature on the development of OSINT artefacts for cybersecurity (N = 73) and an empirical value sensitive design case study, comprising semi-structured interviews with stakeholders (N = 9) as well as a focus group (N = 7) with developers. Based on our results, we identify implications relevant to the research on and design of OSINT artefacts for cybersecurity incident response.

Intrusion Detection in Vehicle Controller Area Network (CAN) Bus Using Machine Learning: A Comparative Performance Study.

Electronic Control Units (ECUs) have been increasingly used in modern vehicles to control the operations of the vehicle, improve driving comfort, and safety. For the operation of the vehicle, these ECUs communicate using a Controller Area Network (CAN) protocol that has many security vulnerabilities. According to the report of Upstream 2022, more than 900 automotive cybersecurity incidents were reported in 2021 only. In addition to developing a more secure CAN protocol, intrusion detection can provide a path to mitigate cyberattacks on the vehicle. This paper proposes a machine learning-based intrusion detection system (IDS) using a Support Vector Machine (SVM), Decision Tree (DT), and K-Nearest Neighbor (KNN) and investigates the effectiveness of the IDS using multiple real-world datasets. The novelty of our developed IDS is that it has been trained and tested on multiple vehicular datasets (Kia Soul and a Chevrolet Spark) to detect and classify intrusion. Our IDS has achieved accuracy up to 99.9% with a high true positive and a low false negative rate. Finally, the comparison of our performance evaluation outcomes demonstrates that the proposed IDS outperforms the existing works in terms of its liability and efficiency to detect cyber-attacks with a minimal error rate.

Cybersecurity Risks and Its Regulations. The Philosophy of Cybersecurity Audit

Since financial institutions are leading targets of cyber attacks, the article’s main goal is to show that without dedicated action, the global financial system will only become more vulnerable as innovation, competition, and the pandemic further fuel the digital revolution. Also, the cost of cybercrime at financial institutions outpaces the cost of cybercrime in other industries. For example, according to a 2019 private study, the per-company cost of cybercrime is over $18 million for financial services companies, around 40% higher than the average cost for other sectors. If the entire system fails to address cybersecurity concerns adequately, this could lead to systemic risk – the risk that a cybersecurity incident would destabilize the financial system. The article considers the level of protection of confidential information in financial enterprises and the means of combating data leaks. In addition, the question of the need for an information technology audit, especially a cybersecurity audit, is raised.

Harmonizing Sensitive Data Exchange and Double-spending Prevention Through Blockchain and Digital Wallets: The Case of E-prescription Management

The digital transformation of the medical sector requires solutions that are convenient and efficient for all stakeholders while protecting patients’ sensitive data. One example that has already attracted design-oriented research are medical prescriptions. However, current implementations of electronic prescription management systems typically create centralized data silos, leaving user data vulnerable to cybersecurity incidents and impeding interoperability. Research has also proposed decentralized solutions based on blockchain technology, but privacy-related challenges have often been ignored. We conduct design science research to develop and implement a system for the exchange of electronic prescriptions that builds on two blockchains and a digital wallet app. Our solution combines the bilateral, verifiable, and privacy-focused exchange of information between doctors, patients, and pharmacies through verifiable credentials with a token-based, anonymized double-spending check. Our qualitative and quantitative evaluations as well as a security analysis suggest that this architecture can improve existing approaches to electronic prescription management by offering patients control over their data by design, a high level of security, sufficient performance and scalability, and interoperability with emerging digital identity management solutions for users, businesses, and institutions. We also derive principles on how to design decentralized, privacy-oriented information systems that require both the exchange of sensitive information and double-usage protection.

Are the good spared? Corporate social responsibility as insurance against cyber security incidents.

Despite the increasing consensus that socially responsible behavior can act as insurance against externally induced shocks, supporting evidence remains somewhat inconsistent. Our study provides a clear demonstration of the insurance-like properties of corporate social responsibility (CSR) in preserving corporate financial performance (CFP), in the event of a data (cyber) breach. Exploring a sample of 230 breached firms, we find that data breaches lead to significantly negative CFP outcomes for low CSR firms, with the dynamic being particularly pronounced in consumer-sensitive industries. Further, we show that firms increase their CSR activities in the aftermath of a breach to recover lost goodwill and regain stakeholder trust. Overall, our results support the use of CSR as a strategic risk-mitigation tool that can curtail the consequences of data breaches, particularly for firms operating in consumer-centric environments.

What Are the Attackers Doing Now? Automating Cyberthreat Intelligence Extraction from Text on Pace with the Changing Threat Landscape: A Survey

Cybersecurity researchers have contributed to the automated extraction of CTI from textual sources, such as threat reports and online articles describing cyberattack strategies, procedures, and tools. The goal of this article is to aid cybersecurity researchers in understanding the current techniques used for cyberthreat intelligence extraction from text through a survey of relevant studies in the literature. Our work finds 11 types of extraction purposes and 7 types of textual sources for CTI extraction. We observe the technical challenges associated with obtaining available clean and labeled data for replication, validation, and further extension of the studies. We advocate for building upon the current CTI extraction work to help cybersecurity practitioners with proactive decision-making such as in threat prioritization and mitigation strategy formulation to utilize knowledge from past cybersecurity incidents.

Cyber Information Retrieval Through Pragmatics Understanding and Visualization

The amount of cybersecurity-related information is extraordinarily increasing, given the fast-growing number of cybersecurity attacks and the significant influence brought by them. How to efficiently obtain and precisely understand the relevant knowledge in the sea of information on cybersecurity becomes a challenge. In this article, we propose an innovative cybersecurity retrieval scheme that supports automatic indexing and searching of cybersecurity information based on semantic contents and hidden metadata. The proposed scheme leverages a customized neural model that incorporates new linguistic features and word embedding by identifying the entities related to cybersecurity incidents from the text. We implement a novel cybersecurity search engine to demonstrate effective, understandable and pragmatic cybersecurity information retrieval based on the proposed schema. Comprehensive performance evaluation over real-world datasets has been conducted to validate the new algorithms and techniques developed for cybersecurity information retrieval. The new engine makes it possible to conduct augmented search, cybersecurity analytics, and visualization, with the ultimate goal of providing direct and efficient results to help people obtain and truly understand cybersecurity information.

Yönetim Bilgi Sistemlerinde (YBS) Siber Güvenliğin Önemi

İçinde bulunduğumuz Bilgi Çağında işletmelerin faaliyetlerini gerçekleştirirlerken Yönetim Bilişim Sistemlerini (YBS) yoğun olarak kullanmaları YBS için Siber Güvenliği (SG) bir zorunluluk getirmiştir. Siber tehdit ve saldırılar neticesinde YBS sistemlerinde oluşabilecek siber güvenlik olayları işletmelerde kullanılan YBS sistemlerinin hizmet dışı kalmasına, işletmelerde ekonomik zararın oluşmasına, işletmelere ait kurumsal, kişisel, sağlık, fikri mülkiyet gibi farklı verilerin zarar görmesine neden olabilecektir. Hatta bu SG olayları ulusal güvenliğin ihlaline kadar etki gösterebilecektir. Bu çalışmada, öncelikle SG ile ilgili kavramların genel çerçevesi çizilmiş, siber güvenlik kapsamında YBS güvenliği araştırılmış, bu çerçevede YBS siber güvenliğinin mevcut farkındalığın artırılmasına ilişkin öneriler getirilmesi amaçlanmıştır. Araştırmada elde edilen sonuçlar, YBS sistemlerinde SG konu, kural ve tedbirlerinin dikkate alınarak uygulanmasının özellikle yöneticiler açısından etkin, hızlı ve doğru karar almada önemli rolü olduğu görülmüş ve SG konularının YBS için kritik öneme haiz bir konu olduğu gözlemlenmiştir. Çalışma neticesinde ayrıca YBS sistemlerinin bilgi güvenliğinin sağlanmasında yerli ve milli bilişim teknolojilerinin kullanımının önemi vurgulanmıştır.

CWE Ontology

CWE is a community-supported database of known weaknesses. It is under permanent update and development. MITRE Corporation hosts this database. It consists of several viewpoints structured at several abstract levels. CWE database is the base of CWE ontology. It redefines weaknesses in terms of the Semantic Web. This ontology is a part of ontology ecosystem developed to capture cybersecurity knowledge on known vulnerabilities, weaknesses, and attacks patterns. CWE ontology classifies CVE/NVD vulnerabilities. It is useful for research and investigation on new vulnerabilities and weaknesses using reasoners. In addition, CWE is useful for cybersecurity incident forensic investigations, software acquisition and development.

CWE Ontology

CWE is a community-supported database of known weaknesses. It is under permanent update and development. MITRE Corporation hosts this database. It consists of several viewpoints structured at several abstract levels.
 CWE database is the base of CWE ontology. It redefines weaknesses in terms of the Semantic Web. This ontology is a part of ontology ecosystem developed to capture cybersecurity knowledge on known vulnerabilities, weaknesses, and attacks patterns.
 CWE ontology classifies CVE/NVD vulnerabilities. It is useful for research and investigation on new vulnerabilities and weaknesses using reasoners. In addition, CWE is useful for cybersecurity incident forensic investigations, software acquisition and development.

Managing the financial impact of cybersecurity incidents

The complex relationships of economic actors and the high dependency on information and communication technologies make it necessary for all relevant entities to develop protection. This protection should include preventive and reactive controls in a risk-proportionate manner in relation to the business value protected. We aimed to develop a solution to support cybersecurity-related business decisions with financial analytics. The risk-based approach helps management find the optimum solution with minimal costs, where protection prevents some incidents from occurring, while the risks associated with other incidents are accepted in an informed way. The security industry developed a number of apparatuses to find the optimum security controls that enforced the fiscal aspects, which typically contain solutions used in planning. However, the actual expenditure often differs from the planned budget for several reasons, one of which is the occurrence of security incidents. We used the common methodology toolset for financial analysis (NPV, NFV, risk assessment). We developed novel metrics based on these that can be used in cybersecurity management. Within the framework thus defined, the article discusses the economic context of the effects of incidents involving Meta (previously Facebook) services from 2016 to 2020. This paper introduces the ‘Effect of incidents’ metric to measure the impact of unplanned incidents’ on actual expenditure compared to the planned budget and the ‘Incidence of incident recognition’ metric to measure deviations of an incident’s impact as perceived by owners relative to the effect on the value of the assets. The paper also proves the applicability of those metrics using the example of Meta.

Modelling language for cyber security incident handling for critical infrastructures

Cyber security incident handling is a consistent methodology with which to ensure overall business continuity. However, specifically handling incidents for critical information infrastructures is challenging owing to the inherent complexity and evolving nature of the threat. Despite the number of contributions made to cyber incident handling, there is little evidence of literature that focuses on modelling activities that will enhance developers’ abilities to model incident handling processes and activities according to different views. Modelling languages of this nature should integrate essential concepts and a descriptive implementation process in order to enable developers to analyse, represent and reason about the crucial incident handling efforts required to support critical information infrastructures. The aim of this paper is, as part of the CyberSANE EU project, to develop a Cyber Incident Handling Modelling Language (CIHML) that focuses explicitly on modelling incident handling in the context of a critical information infrastructure. The work is innovative in its approach because it consolidates concepts from various domains such as security requirements, forensics, threat intelligence, critical infrastructures and cyber incident handling. The approach will allow the phases of the incident handling lifecycle to be modelled from three different views (critical information infrastructures, threat and risk analysis, and incident response). An implementation process is also proposed, which will serve as a comprehensive guide for developers in order to create these modelling views. Finally, CIHML is evaluated using a real-life scenario from the CyberSANE project to demonstrate its applicability. The incident observed had a severe impact on the overall business continuity of the context studied. The results obtained from the study show that CIHML can help critical information infrastructure operators to identify, evaluate, represent and model cyber incidents in critical information systems, in addition to providing the support required to determine the response strategies needed in order to mitigate these cyber-attacks.