Cybersecurity Knowledge Research Articles

Cybersecurity and the politics of knowledge production: towards a reflexive practice

ABSTRACT How does a reflexive scholarly practice matter for producing useful cybersecurity knowledge and policy? We argue that staking relevance without engaging in reflexivity diminishes the usefulness of knowledge produced both in academia and in policy. To advance a reflexive research agenda in cybersecurity, this forum offers a collective interrogation of the liminal positionality of the cybersecurity scholar. We examine the politics of ‘the making of’ cybersecurity expertise as knowledge practitioners who are located across and in between the diverse and overlapping fields of academia, diplomacy and policy. Cybersecurity expertise, and the practices of the cybersecurity epistemic community more broadly, rely heavily on the perceived applicability and actionability of knowledge outputs, on the practical dependency on policy practitioners regarding access, and thus on the continuous negotiation of hierarchies of knowledge. Participants in this forum reflect on their research practice of negotiating such dilemmas. Collectively, we draw on these contributions to identify obstacles and opportunities towards realising a reflexive research practice in cybersecurity.

Modelling of Maritime Cyber Security Education and Training

The existence of sophisticated and integrated cyberspace aboard ships with information technology (IT) and operational technology (OT) makes cybersecurity a crucial concern for the maritime sector. The marine sector has benefited greatly from information and communication technologies, but they have also made ship systems and maritime infrastructure more susceptible to cyberattacks. Cyberattacks on ships have the potential to result in fatalities, severe financial losses, environmental damage, and other negative effects. A model course or specification for maritime cyber security education and training through the International Convention on Standards of Training, Certification, and Watchkeeping for Seafarers (STCW) 1978 has not yet been published by the International Maritime Organization (IMO), despite the fact that MSC.428 mandates cyber security risk management in the safety management system on ships to combat cyber-attacks and improve cyber resistance in maritime environments. The Analytic Hierarchical Process (AHP) technique is used in this work to offer a model for a curriculum for cyber security in the Maritime Education and Training (MET) system. It is possible to identify each competency’s priority in the MET system’s cyber security curriculum by comparing the relative weights assigned to each one. The results of the research provide the Met Institutions with the ability to be proactive and include cyber security knowledge and abilities into proposed curricula.

Socio-Technical Perspective in Determining the Factors and Components for Minimizing Cybersecurity Threat

Smart city development necessitates careful planning and control. Many factors contribute to failures in smart cities, such as the lack of attention in dealing with cyber security threats, misappropriation of internet facilities, and limitedness of awareness and knowledge of basic-level cybersecurity to safely perform daily activities. Numerous studies have discovered that procrastinating, impulsive, forward-thinking, and risk-taking behaviours vary across organizations, which may help to explain why different organizations adhere to security policies. This research aims to analyse the socio-technical structural relationship of socio-technical perspective in determining the factors and components for minimizing security threat. The research uses a mixed-methods study while the results regarding the contribution of socio-technical components to the improvement of work behaviour in minimizing cybersecurity threats and proposes new analysis result of the contribution work behaviours as contribution and a positive influence for minimizing cybersecurity threat toward successful smart city.

Cybersecurity knowledge graphs construction and quality assessment

Cyber-attack activities are complex and ever-changing, posing severe challenges to cybersecurity personnel. Introducing knowledge graphs into the field of cybersecurity helps depict the intricate cybersecurity landscape and provides technical support for threat identification and situational awareness. However, during the process of constructing knowledge graphs, inevitable noise and conflicts may be introduced, leading to misleading inferences and decisions. This paper aims to address the issues of constructing and assessing the quality of cybersecurity knowledge graphs. We manually constructed a dataset of cybersecurity knowledge graphs (CS13K) and expanded the existing cybersecurity ontology, building a more versatile ontology applicable to existing data features. Building upon this, we utilized Neo4j to construct the cybersecurity knowledge graph. Furthermore, we propose an AttTucker model, based on Transformer, for assessing the quality of knowledge graphs. By employing numerous self-attention heads, this model captures latent information among entities and relations. While reducing the dimensionality of knowledge embeddings, the model achieves evaluation results comparable to high-dimensional embeddings. Finally, we incorporate the path-level information between entities in the knowledge graph into the evaluation of knowledge graph quality based on the AttTucker model. Experimental analysis on both generic datasets and cybersecurity datasets demonstrates that our model significantly improves F1 value and accuracy in knowledge graph quality assessment tasks, outperforming other models.

Artificial intelligence enabled cyber security defense for smart cities: A novel attack detection framework based on the MDATA model

Smart cities have attracted a lot of attention from interdisciplinary research, and plenty of artificial intelligence based solutions have been proposed. However, cyber security has always been a serious problem, and it is becoming more and more severe in smart cities. The existing attack defense methods are not suitable for detecting multi-step attacks since the detection rules are limited and the efficiency is limited by a large number of false security alarms. Hence, an advanced solution is urgently needed to improve cyber security defense capability. In this paper, we propose a novel attack detection framework called ACAM. To better represent the cyber security knowledge, the framework is based on the MDATA model, which can represent dynamic and temporal–spatial knowledge better than the knowledge graph. The framework consists of the knowledge extraction module, the subgraph generation module, the alarm correlation module, and the attack detection module. These modules can remove false alarms and improve the detection capabilities of multi-step attacks. We implement the framework and conduct experiments on the cyber range platform, the experimental results validate the good performance of attack detection accuracy and efficiency. The framework can greatly improve the cyber security defense capabilities for smart cities.

How Effective are SETA Programs Anyway: Learning and Forgetting in Security Awareness Training

Prevalent security threats caused by human errors necessitate security education, training, and awareness (SETA) programs in organizations. Despite strong theoretical foundations in behavioral cybersecurity, field evidence on the effectiveness of SETA programs in mitigating actual threats is scarce. Specifically, with a broad range of cybersecurity knowledge crammed into in a single SETA session, it is unclear how effective different types of knowledge are in mitigating human errors in a longitudinal setting. his study investigates how knowledge gained through SETA programs affects human errors in cybersecurity to fill the longitudinal void. In a baseline experiment, we establish that SETA programs reduce phishing susceptibility by 50%, whereas the training intensity does not affect the rate. In a follow-up experiment, we find that SETA programs can increase employees’ cybersecurity knowledge by 12-17%, but the increment wears off within a month. Furthermore, technical-level knowledge decays faster than application-level knowledge. The longer “shelf-life” of application-level knowledge explains why training intensity makes no difference within a month. This study reveals a (relatively) more effective component of SETA programs and cast doubts on the overall effectiveness of SETA programs in the long run.

Machine-Learning-Based Password-Strength-Estimation Approach for Passwords of Lithuanian Context

In an information-security-assurance system, humans are usually the weakest link. It is partly related to insufficient cybersecurity knowledge and the ignorance of standard security recommendations. Consequently, the required password-strength requirements in information systems are the minimum of what can be done to ensure system security. Therefore, it is important to use up-to-date and context-sensitive password-strength-estimation systems. However, minor languages are ignored, and password strength is usually estimated using English-only dictionaries. To change the situation, a machine learning approach was proposed in this article to support a more realistic model to estimate the strength of Lithuanian user passwords. A newly compiled dataset of password strength was produced. It integrated both international- and Lithuanian-language-specific passwords, including 6 commonly used password features and 36 similarity metrics for each item (4 similarity metrics for 9 different dictionaries). The proposed solution predicts the password strength of five classes with 77% accuracy. Taking into account the complexity of the accuracy of the Lithuanian language, the achieved result is adequate, as the availability of intelligent Lithuanian-language-specific password-cracking tools is not widely available yet.

Who Is Best Placed to Support Cyber Responsibilized UK Parents?

The UK government responsibilizes its citizens when it comes to their cyber security, as do other countries. Governments provide excellent advice online, but do not provide any other direct support. Responsibilization is viable when: (1) risk management activities require only ubiquitous skills, (2) a failure to manage the risk does not affect others in the person's community. Cybersecurity fails on both counts. Consider that parents and carers are effectively being responsibilized to educate their children about cybersecurity, given that young children cannot be expected to consult and act upon government advice. Previous research suggests that UK parents embrace this responsibility but need help in keeping up to date with cybersecurity 'best practice'. In this paper, we consider a number of possible sources of parental advice, and conclude that support workers would be best placed to support parents in this domain. We then carried out a study to gauge the acceptability of this source of help. We find that parents would be willing to accept advice from this source, and suggest that cybersecurity academics be recruited to train support workers to ensure that they have current 'best practice' cybersecurity knowledge to impart to parents.

Exploring the Relationship Between Cybersecurity Culture and Cyber-Crime Prevention: A Systematic Review

Cybercrime requires a multidimensional approach addressing technical, organisational, and human factors to prevent cyber-attacks. This systematic review highlights the significance of a strong cybersecurity culture in mitigating the risks of cyberattacks and enhancing an organisation's resilience. Implementing training and awareness programmes, establishing leadership support and accountability mechanisms, and fostering employee engagement are strategies for promoting a strong cybersecurity culture. However, fostering a robust culture of cybersecurity can be challenging and requires the participation of various stakeholders. Training and awareness programmes can significantly improve employee cybersecurity knowledge and behaviour, and leadership support is essential for establishing a cybersecurity culture. It is possible to enforce employee compliance with cybersecurity policies and procedures through accountability mechanisms, such as consequences for noncompliance and periodic security audits. Involving employees in the creation of cybersecurity policies and procedures, as well as recognising and rewarding responsible behaviour, can increase employee engagement and investment in cybersecurity. Although technical measures such as firewalls and encryption are essential for defending against cyber-attacks, a strong cybersecurity culture is necessary to mitigate cybercrime risks and enhance an organisation's resilience. Future research should identify and evaluate effective strategies for cultivating a robust cybersecurity culture in the context of preventing cybercrime. Cybersecurity should be a top priority for businesses and individuals, who must take preventative measures against cyber-attacks. By fostering a robust culture of cybersecurity, businesses can increase their resilience and reduce the risks of cybercrime.

A framework for threat intelligence extraction and fusion

Cyber-attacks, with various emerging attack techniques, are becoming increasingly sophisticated and difficult to deal with, posing great threats to companies and every individual. Therefore, analyzing attack incidents and tracing the attack groups behind them becomes extremely important. Threat intelligence provides a new technical solution for attack traceability by constructing Cybersecurity Knowledge Graph (CKG). In this paper, we propose a framework for threat intelligence extraction and fusion, which is able to extract, correlate and unify cybersecurity entity-relation triples from structured and unstructured data. However, the existing entity and relation extraction for cybersecurity concepts uses the traditional pipeline model that suffers from error propagation and ignores the connection between the two subtasks. To solve the above problem, we propose a joint entity and relation extraction model for cybersecurity concepts. We model the joint extraction problem as a multiple sequence labeling problem, generating separate label sequences for different relations, which contain information about the involved entities and the subject and object of that relation. Experimental results on Open Source Intelligence (OSINT) data show that the F1 value of the joint model is 81.37%, which is better than the previous pipeline model. For the knowledge fusion, we propose an improved Levenshtein distance to correlate the same entities extracted from different data sources to construct a preliminary CKG, which is demonstrated in the Experiments section.

A Structural Equation Approach and Modelling of Pre-service Teachers' Perspectives of Cybersecurity Education

AbstractThe increasing technology reliance in today’s world has amplified the need for cybersecurity education for all. Hence, initiatives regarding the integration of cybersecurity education within the pre-college level have begun to emerge in recent times. However, limited research exists regarding in-service or pre-service teachers’ perspectives on this phenomenon. More importantly, the need to understand pre-service teachers’ perceptions; since their perceptions may significantly influence how the prospective teachers respond to cybersecurity issues and also affect their behavior toward learning and promoting cybersecurity education in the future. Consequently, in order to gain insight into how candidates entering the teaching profession regard cybersecurity, 451 pre-service teachers were sampled in a major public university in Lesotho. The prospective teachers recruited across various departments in the faculty of education responded to an online survey that comprised 33 items gauged from five constructs which include personal cybersecurity awareness, perceived self-efficacy of learning cybersecurity, personal relevance of cybersecurity knowledge, behavioral intention towards learning cybersecurity and actual learning of cybersecurity. We analyzed the response from the survey by utilizing the structural equation modelling approach. Our findings showed that our hypothesized model was mostly accepted. The result suggests that practitioners and researchers in the related field need to raise the pre-service teacher’s behavioral intention to learn cybersecurity by helping them realize the implication for their personal lives and society. We discussed our findings in relation to the proposed research model and highlighted the implication for teacher education programs. Finally, the article concludes with limitations and identifies future research agenda.

Demand Analysis of the Cybersecurity Knowledge Areas and Skills for the Nurses: Preliminary Findings

The purpose of this paper is to present a preliminary analysis of the cybersecurity market demand in the nursing and health sector. Currently, the market demand study is ongoing under the Digital Europe Programme CyberSecPro project, which strengthens the role of higher education institutions as a provider of practical and working life skills. The project promotes reliable digital transformation in critical sectors, such as healthcare. The rapid development of e-health emphasizes the central position of cybersecurity in healthcare organizations that are increasingly the targets of cyber-attacks. This descriptive literature review explores what a nurse needs to know about cybersecurity. Our results show that awareness of cyber risks is weak in the healthcare sector. Understanding cyber risks and recognizing the effects of one's own activities increases the cybersecurity of the entire organization, therefore cybersecurity training for nurses should be increased. Our study suggested that nurses’ most important cyber skills are their own cyber-safe way of operations, identifying cyber threats related to equipment, identifying the effects of cyber disruptions, and acting in a cyber disruption situation. Future nurse training programs should be updated to include these skills. Additionally, the teaching of nurses must be developed so that it meets these competence needs.

Effects of cybersecurity knowledge and situation awareness during cyberattacks on autonomous vehicles

Autonomous vehicles offer many potential benefits; however, this expansion of cyber-physical systems also introduces a new potential vulnerability through cybersecurity threats. It is therefore important to understand the role vehicle occupants can play in preventing and responding to cyberattacks. The objective of this study is to (1) evaluate drivers’ responses to unexpected cyberattacks, and (2) evaluate how cybersecurity knowledge affects situation awareness (SA) during cyberattacks on automated driving. A driving simulator study with 20 participants was conducted to measure drivers’ performance during unexpected cyberattacks on a SAE Level 2 partially-autonomous vehicle and the infrastructure in the driving environment. Each participant experienced four driving scenarios, each scenario with a different cyberattack. Two cyberattacks were directly on the vehicle and two were on the infrastructure. Situation Awareness Global Assessment Technique (SAGAT) was used to measure participants’ situation awareness during the drives and at the time of the cyberattacks. Participant takeover responses to the cyberattacks were collected through the driving simulator. Participants also completed a cybersecurity knowledge survey at the end of the experiment to assess their previous overall cyber awareness and experience with autonomous vehicles. Most of the participants recognized the cyberattacks, however only about half of the participants chose to takeover control of the vehicle during the attacks, and in one attack no one overtook the automation. Results from ANOVAs showed significantly higher SA for participants with greater familiarity with cybersecurity terms and vehicle-to-everything technology. In addition, SA scores were significantly higher for participants who believed security systems (i.e., firewall, encryption) are important and for those who felt protected against cybercrimes. The present results suggest that increased cybersecurity knowledge can cause a high level of situation awareness during automated driving, which can help drivers to control unexpected driving situations due to cybersecurity attacks.

The Role of Cybersecurity Knowledge and Awareness in Cybersecurity Intention and Behavior in the United States

Despite the rapid escalation of cybercrimes in modern society, few viable cybersecurity and cybercrime prevention programs exist. Consequently, this research considers cybersecurity as a key element for mitigating the potential risk and incidents of cybercrime. The study aims to understand the role of individuals’ cybersecurity knowledge and awareness in shaping their cybersecurity intention and behavior in the United States. The results reveal that information and communications technology variables, education, income, and gender are contributing predictors of a level of cybersecurity knowledge. The effects of information and communications technology variables varied across gender for both correct and uncertain responses. The findings highlight the importance of a comprehensive understanding of both technical and human/individual factors for cybersecurity knowledge and education.

Cybersecurity threats and vulnerabilities experienced by small-scale African migrant traders in Southern Africa

AbstractCybersecurity threats have increased as the world becomes increasingly interconnected. Whilst the use of technology to facilitate commercial activities is now common practice, there is a need to limit exposure to these threats so that traders can transact safely. This study aimed to identify and analyse common cybersecurity vulnerabilities and threats experienced by small-scale African migrant traders in Southern Africa. A qualitative approach was employed and semi-structured and key informant interviews were conducted to gather the primary data, with secondary data sourced from the relevant literature. The study found that the majority of the small-scale traders experienced hacking while using their mobile devices for transacting. Moreover, most reported a lack of knowledge of cybersecurity and were therefore vulnerable to further threats. It is recommended that small-scale traders be capacitated with relevant technical information to enhance their understanding of cybersecurity risks that can negatively affect their commercial activities. There is also a need for further research to identify mitigation techniques and infrastructure to protect small-scale traders.

Citizen-centric cybersecurity model for promoting good cybersecurity behaviour

ABSTRACT The ultimate success of cybersecurity partly depends on good behaviours by Internet users. However, good cybersecurity behaviour is a major challenge among citizens because they lack cybersecurity knowledge in the use of the Internet and digital devices and generally, there is a misalignment between attitudes and behaviour of people which creates bristly tension in cyberspace. In an endeavour to promote cybersecurity behaviour, attitudes and behaviour of Internet users should be combined with knowledge. This study builds from the Protection Motivation Theory (PMT) to feed into the development of a citizen-centric cybersecurity model for promoting good cybersecurity behaviour. The theory assumes that threat appraisals and coping appraisals are the two foundational mechanisms underlying behavioural actions when individuals are faced with threatening events; hence, it provided a solid foundation for the conceptual model of the study. The model was tested on data collected from 464 participants. Each of the three independent latent variables (Attitude, Behavioral Intention and Cybersecurity Knowledge) has a P-value less than 0.05 in our situation, indicating that each of the independent latent factors affects Behavior. The findings of this study make a significant contribution both to theory and practice to implement a citizen-centric cybersecurity model.

ID: 214173 Evaluating Physician Understanding of Data Privacy and Cybersecurity in Neuromodulation Systems

Advances in Implantable Medical Devices (IMDs) with wireless communication features have provided healthcare providers with new capabilities, such as remote device programming and patient monitoring.[1] Unfortunately, reliance on software and networks for wireless communication with IMDs allows for vulnerabilities to outside attack. Patients with neuromodulation devices represent a unique group of potential targets to hackers because of the data points these devices collect and can transmit. Healthcare providers bear the responsibility of educating patients on the data privacy and cybersecurity risks involved with IMDs. Little research has been done to learn what practicing physicians understand about these issues. We seek to investigate healthcare provider knowledge of neuromodulation device cybersecurity and data privacy using survey data analysis.

Making Sense of the Unknown: How Managers Make Cyber Security Decisions

Managers rarely have deep knowledge of cyber security and yet are expected to make decisions with cyber security implications for software-based systems. We investigate the decision-making conversations of seven teams of senior managers from the same organisation as they complete the Decisions & Disruptions cyber security exercise. We use grounded theory to situate our analysis of their decision-making and help us explore how these complex socio-cognitive interactions occur. We have developed a goal-model (using iStar 2.0) of the teams’ dialogue that illustrates what cyber security goals teams identify and how they operationalise their decisions to reach these goals. We complement this with our model of cyber security reasoning that describes how these teams make their decisions, showing how each team members’ experience, intuition, and understanding affects the team’s overall shared reasoning and decision-making. Our findings show how managers with little cyber security expertise are able to use logic and traditional risk management thinking to make cyber security decisions. Despite their lack of cyber security–specific training, they demonstrate reasoning that closely resembles the decision-making approaches espoused in cyber security–specific standards (e.g., NIST/ISO). Our work demonstrates how organisations and practitioners can enrich goal modelling to capture not only what security goals an organisation has (and how they can operationalise them) but also how and why these goals have been identified. Ultimately, non–cyber security experts can develop their cyber security model based on their current context (and update it when new requirements appear or new incidents happen), whilst capturing their reasoning at every stage.

PipCKG-BS: A Method to Build Cybersecurity Knowledge Graph for Blockchain Systems via the Pipeline Approach

The increasing sophistication of cyberattacks on blockchain systems has significantly disrupted security experts from gaining immediate insight into the security situation. The Cybersecurity Knowledge Graph (CKG) currently provides a novel technical solution for blockchain system situational awareness by integrating massive fragmented Cyber Threat Intelligence (CTI) about blockchain technology. However, the existing literature does not provide a solution for building CKG appropriate for blockchain systems. Therefore, designing a method to construct a CKG for blockchain systems by efficiently extracting information from the CTI is mandatory. This paper proposes PipCKG-BS, a pipeline-based approach that builds CKG for blockchain systems. The PipCKG-BS incorporates contextual features and Pre-trained Language Models (PLMs) to improve the performance of the information extraction process. Precisely, we develop the Named Entity Recognition (NER) and Relation Extraction (RE) models for cybersecurity text in PipCKG-BS. In the NER model, we apply the prompt-based learning paradigm to cybersecurity text by constructing prompt templates. In the RE model, we employ external features and prior knowledge of sentences to improve entity relationship extraction accuracy. Several experimental results demonstrate that PipCKG-BS is better than advanced methods in extracting CTI information and is an appealing solution to build high-quality CKG for blockchain systems.

Cyber security in university libraries and implication for library and information science education in Nigeria

Purpose Technological expansion and adoption in university libraries have precipitated cybercrimes and the need to equip library personnel with the required knowledge to combat this menace. Consequently, this study aims to examine cyber security in university libraries and its implication for Library and Information Science education. Design/methodology/approach The study adopted descriptive research design, while questionnaire and interview were used to elicit data from library personnel and heads of library schools, respectively. A total of 134 responses were elicited through structured questionnaire (administered online due to the closure of universities) while six heads of library schools were interviewed, one from each of the six geopolitical zones in Nigeria. Findings The data from the questionnaire which were descriptively analysed revealed that the perceived knowledge of cyber security among the librarians was moderately low. Also, the university libraries were exposed to various cyber threats, with cyber security/guideline been one of the critical measures to combat cybercrime. Also, the result showed that librarians displayed high level of adherence to cyber ethics. However, the disposition of library management towards cyber security issues was revealed to be the main challenge to the deployment of cyber security in university libraries, follow by poor password management. Majority of the librarians possess basic knowledge of cyber security, though with serious interest to learn more about it. They were not taught cyber security in library school and they indicated enthusiasm to learn about it. The result of the interview with heads of library schools showed majority of these schools do not offer cyber security course due to dearth in skilled manpower. Originality/value The study presents cybercrime as a menace, if not tackled, would affect the university libraries’ sustainability as information institution, compromising their ability to deliver quality services.