Cybersecurity Policy Research Articles

Exploring The Landscape of Cyber Crimes Targeting Women: A Literature Review on Cyber Security Laws

خلفية الدراسة ومشكلتها: مع استمرار التكنولوجيا في التقدم وإعادة تشكيل حياتنا، أصبح العالم الرّقمي أرضًا خصبة لمختلف أشكال الجرائم الإلكترونية، بما فيها تلك التي تستهدف النساء على وجه الخصوص. ومع تزايد انتشار التقنيات الرّقمية واستخدام الإنترنت، أصبح تعرض النساء لمختلف أشكال الجرائم الإلكترونية مصدر قلق مُلّح. الأهداف: تقدم هذه الورقة البحثية مراجعة شاملة للأدبيات حول مشهد الجرائم الإلكترونية التي تستهدف النساء في سياق قوانين الأمن السيبراني، بهدف استكشاف طبيعة ومدى الجرائم السيبرانية ضد النساء، مع التركيز على الجرائم الرئيسة مثل التحرش عبر الإنترنت، والمطاردة السيبرانية، والمواد الإباحية دون الموافقة، وسرقة الهوية عبر الإنترنت. الطرق المستخدمة: تم تحليل ما يُقارب من 60 مقالًا ودراسة تتعلق بالموضوع بشكل شامل في هذه الورقة البحثية، مما يسلط الضوء على الطبيعة المتطورة للجرائم الإلكترونية ضد النساء، والحاجة إلى أُطر قانونية قوية لحمايتهِنّ وتمكينهِنّ في العصر الرّقمي. بالإضافة إلى ذلك، تم فحص قوانين الأمن السيبراني الحالية وفعاليتها في التصدي لهذه الجرائم بشكل نقدي. النتائج: تؤكد نتائج هذا البحث أهمية اتخاذ تدابير شاملة، بما في ذلك التحديثات التشريعية، وحملات التوعية، وتعزيز جهود إنفاذ القانون، لمكافحة الجرائم الإلكترونية التي تستهدف النساء بشكل فعّال. الاستنتاجات (التوصيات والمساهمة): من الواضح أنّ قوانين الأمن السيبراني الحالية تحتاج إلى تعزيز وتكييف لمواجهة هذه الجرائم بشكل فعّال، كما أنّ هناك حاجة إلى نهج متعدد الأوجه لتعزيز حماية النساء ضد الجرائم السيبرانية.

A Controversial Hypercritical Examination of Cybersecurity Policies in Pakistan that Cannot Be Ignored

A Controversial Hypercritical Examination of Cybersecurity Policies in Pakistan that Cannot Be Ignored

Analyzing the Sunpharma Ransomware Attack: Implications for Cybersecurity Laws, Regulations, and Guidelines in the Pharmaceutical Industry

Analyzing the Sunpharma Ransomware Attack: Implications for Cybersecurity Laws, Regulations, and Guidelines in the Pharmaceutical Industry

Impact of Cybersecurity Regulations on Corporate Compliance Practices in Japan

Purpose: The aim of the study was to analyze impact of cybersecurity regulations on corporate compliance practices in Japan. Methodology: This study adopted a desk methodology. A desk study research design is commonly known as secondary data collection. This is basically collecting data from existing resources preferably because of its low cost advantage as compared to a field research. Our current study looked into already published studies and reports as the data was easily accessed through online journals and libraries. Findings: In Japan, cybersecurity regulations have significantly influenced corporate compliance practices. The Act on the Prohibition of Unauthorized Computer Access, along with the Penal Code, outlines stringent measures against cybercrimes, mandating corporations to adopt robust cybersecurity protocols to protect against unauthorized access and data breaches. Furthermore, comprehensive data protection laws, such as the Act on the Protection of Personal Information (APPI), require companies to obtain explicit consent for data processing, ensuring a higher standard of data privacy and security compliance. Unique Contribution to Theory, Practice and Policy: Institutional theory, resource dependence theory & contingency theory may be used to anchor future studies on cybersecurity regulations on corporate compliance practices. Organizations should prioritize building a robust cybersecurity governance framework that integrates regulatory compliance requirements into broader risk management strategies. Policymakers and regulators should adopt a risk-based approach to cybersecurity regulation that takes into account the diverse needs and capabilities of organizations across different sectors and geographical regions.

Cyber Security and Legal Protection for Dropshipping Transactions in Indonesia: between State Law and Islamic Law

This study aims to explain the cybersecurity and legal protection of dropshipping transactions from the Indonesian and Islamic economic law perspective. The normative and comparative judicial approaches were applied to achieve the research objectives. Descriptive and prospective analysis methods are used, and data are collected through primary and secondary sources. The findings revealed that despite the continuous growth of dropshipping contracts, Indonesia has no direct laws and regulations that particularly deal with the dropshipping mechanism and provide this cyber security to the system. In Islam, the dropshipping mechanism is linked with three types of contracts: Salam, Samsarah, and Wakalah. However, each type carries certain limitations as per Islamic/Sharia principles. Simultaneously, along with the cyber security laws available in financial transactions, the Islamic Fatwa can be regarded as a guide for dealing with dropshipping agreements and preventing cyber security. Furthermore, considering the increasing trend of dropshipping businesses, which is beneficial for the economic system, the existing cybersecurity laws and regulations must be amended to explicitly cover drop-shipping mechanisms.

The Impact of Operational Technology Requirements in Maritime Industries

The maritime ecosystem and industry require more efficient and coordinated cybersecurity governance. No common cybersecurity mechanism in the maritime sector may steer the whole supply chain management, for example, in the port areas and fairways. Cyberthreat prevention mechanisms in harbor areas and port terminals must be standardized more in the Western world. It has been recognized that understanding cybersecurity of operational technology in the harbor area is based on a more traditional experience of what it requires. The overall security of the maritime ecosystem requires more than random checks of passengers and vehicles and customs functions on cargo and passenger transportation, which are mainly physical security service routines. Traditional physical threats have changed to a combination of threat types. Hybrid threats may prevent everyday harbor activities so that damage can become long-lasting and harm overall business continuity management. It is crucial to prevent cyber threat factors in the maritime domain. The research provides transnational and EU-level cyber security assessments regarding cyber security regulation. The findings determine where to direct and concentrate a focus maritime domain and why it is essential to survey cyber security requirements set for member states to apply. In Finland, this research belongs to the cybersecurity governance of operational technology in the sector connected to the smart energy networks (CSG) research program. The project aims to develop a common cybersecurity governance model for operational technology.

The Importance of Cybersecurity Governance Model in Operational Technology Environments

There is a common will to unify regulation in the Western world regarding overall security, including cybersecurity. European cyber security regulations aim to create a foundation and guidelines for international standards in various industries and the operation of critical infrastructure. Protected critical infrastructure is a common goal for Western allies. Allies of NATO and EU member states mainly support the anti-aggression policy in Europe. The unstable situation in the world forces states to find solutions that represent the thoughts of the allies. Defending common values is crucial when the purpose is to protect critical infrastructure and vital functions in societies. The research will demonstrate the industrial needs of IT/OT-related cybersecurity governance. The study analyzes EU-level cybersecurity requirements and how those requirements affect standardization regarding cybersecurity governance in the operational technology environment. There will be four primary governance levels: Political, Strategical, Operational and Tactical. Many criminal state-linked operators do not care about international agreements or contracts. Some rogue states have even taken to inciting violations of international agreements. We cannot trust the loose contracts between states anymore. The research will find the main challenges concerning the cybersecurity governance of the industrial organizations that use operational technology-related technology in their daily businesses. We have seen that Information and Operational Technology are based on something other than similar threats and risk basements. Operational Technology-related threats threaten the cyber-physical ecosystem where anomalies affect the physical world, so operational functions of equipment, devices, sensors, components, and production lines are interrupted. As a result, continuity management and supply chain management are compromised. The study's primary purpose is to describe the cybersecurity governance elements of the OT environment for enhancing situational awareness. Standardizing the cybersecurity level among industrial stakeholders requires EU member states to have a national cybersecurity strategy that follows main EU-level guidelines. Despite the EU member states' implementation level of the regulation, the EU-level cybersecurity requirements obligate companies to take steps to solve future cybersecurity challenges.

A Stakeholder Needs Analysis in Cybersecurity: A Systemic Approach to Enhancing Digital Infrastructure Resilience

The escalating complexity and sophistication of cyber threats necessitate advanced solutions that not only counteract these threats but also proactively adapt to the evolving needs of diverse stakeholders involved in digital infrastructures, such as telecom operators, cloud service providers, and end-users in sectors like healthcare and finance. This research addresses a crucial gap by focusing on a systemic, AI-powered approach to stakeholder needs analysis in cybersecurity. By aligning closely with stakeholder requirements, the proposed framework aims to offer dynamic, responsive cybersecurity solutions that enhance the resilience of digital infrastructures against evolving cyber threats. This research systematically maps the landscape of stakeholder needs in cybersecurity across different sectors through qualitative methods like interviews and focus groups, supplemented by data from the CyberSecDome project’s pilot cases and open calls. Requirements for an AI-driven framework are then formulated based on these data to identify patterns and predict stakeholder needs. The analysis reveals critical challenges faced by stakeholders, including limited threat intelligence sharing, insufficient automation in incident response, and regulatory hurdles related to data protection laws and evolving cybersecurity legislation. There is a strong interest in leveraging AI for enhanced intrusion detection, real-time threat intelligence sharing, and privacy-preserving information exchange.

Understanding Local Government Cybersecurity Policy: A Concept Map and Framework

Cybersecurity is a crucial concern for local governments as they serve as the primary interface between public and government services, managing sensitive data and critical infrastructure. While technical safeguards are integral to cybersecurity, the role of a well-structured policy is equally important as it provides structured guidance to translate technical requirements into actionable protocols. This study reviews local governments’ cybersecurity policies to provide a comprehensive assessment of how these policies align with the National Institute of Standards and Technology’s Cybersecurity Framework 2.0, which is a widely adopted and commonly used cybersecurity assessment framework. This review offers local governments a mirror to reflect on their cybersecurity stance, identifying potential vulnerabilities and areas needing urgent attention. This study further extends the development of a cybersecurity policy framework, which local governments can use as a strategic tool. It provides valuable information on crucial cybersecurity elements that local governments must incorporate into their policies to protect confidential data and critical infrastructure.

Legal Regulation of Cybersecurity and Privacy on the Internet

Objective: This article examines the conceptual framework for forming and developing legal regulation of cybersecurity and privacy on the Internet. Theoretical Framework: The article aims to highlight the evolution and future prospects of legal regulation concerning cybersecurity and privacy in both Ukraine and globally. Method: The methodological principles include impartiality and unbiasedness and a comprehensive study of the legislative framework and its specifics in the context of cybersecurity and privacy. Results and Discussion: The legislative experiences of international law on cybersecurity and privacy have been summarized. In Ukraine, the legal support process for cybersecurity and privacy continues, with the country ratifying several international documents and developing its own legislative framework. Research Implications: The term "cybersecurity" has been legislatively defined, encompassing 10 fundamental principles regarding the Internet's development and impact on human life. Originality/Value: The terms "cybersecurity," "cybercrime," and "privacy in the virtual space" require further refinement. A methodology that facilitates the interaction and coexistence of legal norms and netiquette is needed.

Beyond Algorithmic Disclosure for Generative AI

One of the most commonly recommended policy interventions with respect to algorithms in general and artificial intelligence (“AI”) systems in particular is the need for greater transparency, often focusing on the disclosure of the variables employed by the algorithm and the weights given to those variables. This Essay argues that any meaningful transparency regime must provide information on other critical dimensions as well. For example, any transparency regime must also include key information about the data on which the algorithm was trained, including its source, scope, quality, and inner correlations, subject to constraints imposed by copyright, privacy, and cybersecurity law. Disclosures about pre-release testing also play a critical role in understanding an AI system’s robustness and its susceptibility to specification gaming. Finally, the fact that AI, like all complex systems, tends to exhibit emergent phenomena, such as proxy discrimination, interactions among multiple agents, the impact of adverse environments, and the well-known tendency of generative AI to hallucinate, makes ongoing post-release evaluation a critical component of any system of AI transparency.

An Incident Management System Design to Protect Critical Infrastructures from Cyber Attacks

In recent years, there has been a noticeable trend toward targeted threats to information security, where companies are now leveraging vulnerabilities and risks associated with widely used services in order to generate financial gain. Additionally, they implement numerous precautions and consistently carry out their tasks. One item that requires precautionary measures is the network devices utilized. Network devices in computer networks possess the capability to log events. These logs enable the identification of security events on the network and facilitate the implementation of precautionary measures. Various security measures can be implemented to handle such data. One of these measures is Security Information and Event Management (SIEM). It is a system that gathers and analyzes data from networks and security devices. SIEM is a technique employed to consolidate critical information within a cohesive structure. It allows for the correlation of events from different security devices, thereby improving the monitoring capabilities of cybersecurity operations centers. This study extensively covers the critical infrastructure-SIEM relationship, current studies, critical infrastructure, cyber security policies, and SIEM. Our system design was developed using the UNSW\_NB15 dataset, a widely recognized dataset in cybersecurity due to its comprehensive and realistic representation of cyber threats. This dataset consists of data obtained from network traffic, various attack activities, and real-life modern normal scenarios, making it particularly relevant to our study. With the studies, a total of 10 different categories were analyzed, with the category consisting of nine types of attacks, namely Analysis, Backdoor, DoS, Exploits, Fuzzers, Generic, Reconnaissance, Shellcode, and Worms and Normal activities. The study is divided into two as the basic structure. The first step was carried out on Google Collaboratory, and then some experimental studies were carried out in Weka. Classifications were made using several methods, including Logistic Regression (LR), Extra Trees (XT), Support Vector Machines (SVM), Random Forest (RF), and Decision Trees (DT). These methods were chosen for their proven effectiveness in similar studies. In the application developed with Google Colabratory, we achieved 98.62\% in Random Forest, 99.10\% in Decision Trees, 98.87\% in Logistic Regression, 95.13\% success in Extra Trees and 99.12\% success in Support Vector Machines. As a result of the studies and experiments carried out in Weka, we achieved 92.05\% in Random Forest, 100\% in Decision Trees, 100\% in k-Nearest Neighbours, 100\% in J48, 99.19\% in Naive-Bayes and 99.35\% in BayesNet achievements.

Analysis of GDPR Compliance in Utilizing Personal Data for Public Health Purposes in Romania.

The General Data Protection Regulation (GDPR), which became effective on May 25, 2016, underscored the significance of confidentiality across various economic and social domains. Within the medical sector, confidentiality of patient health information is meticulously governed by laws, e.g., no. 95/2006 and no. 46/2003. While these laws address numerous privacy aspects within the doctor-patient relationship, it becomes necessary to update them to align with the latest advancements in emerging technologies, particularly in the context of telemedicine. Upon reviewing the overview of rules pertaining to health data processing in Romania, as published by the European Data Protection Board (EDPB) in 2021, and comparing it with the current public health and research laws in Romania, it becomes apparent that there is a regulatory gap concerning the secondary use of health data. This gap is particularly notable in terms of planning, managing and enhancing the healthcare system, as well as utilizing such data for scientific and historical research purposes, leading to the necessity of developing and regulating the European Health Data Space. Although steps have been taken to align the GDPR legislation in Romania, there is still a disproportionality in the regulation of privacy and cyber security with the implementation of new technologies that will collect, process and store sensitive medical data.

Proteção de dados: experiência internacional e o caso brasileiro – relação com a segurança da informação e a governança cibernética

This article presents an analysis of the main aspects related to privacy in the digital environment and the regulations that deal with the subject and its evolution, highlighting the issue of data protection both in Brazil and in other countries and blocs. In relation to the General Data Protection Law in Brazil, a detailed study has been carried out on the evolution of the issue in the country and the repercussions that the law has caused, especially in relation to the need to expand information security and cyber governance. Also reviewed are events that occurred, such as the episode of Edward Snowden’s accusations, which, together with the advent of the General Data Protection Law, led to the need to expand the Brazilian regulation that deals with cybersecurity, thus bringing the aspects that led to the elaboration and publication of a National Cybersecurity Policy in Brazil. Aspects related to surveys and audits carried out by the Federal Audit Court, the country’s external control body, are also covered, with the aim of evaluating the actions and risks related to the protection of personal data, in terms of government actions, which raises the need to issue new regulations and, once they are in force, to know data on their implementation.

Digital transformation in SMEs: Identifying cybersecurity risks and developing effective mitigation strategies

This study delves into the cybersecurity landscape for small and medium-sized enterprises (SMEs), focusing on identifying prevalent cybersecurity risks, evaluating existing mitigation strategies, and exploring the role of innovation and technology in bolstering cyber resilience. Employing a systematic literature review and content analysis, the research scrutinizes academic journals, industry reports, and government publications from 2015 to 2024, to gather insights into the cybersecurity challenges and strategies pertinent to SMEs. Key findings reveal that SMEs are particularly vulnerable to a range of cyber threats, including phishing, malware, data breaches, and ransomware, primarily due to resource constraints, lack of awareness, and inadequate cybersecurity measures. Effective mitigation strategies highlighted include the adoption of comprehensive cybersecurity policies, regular employee training, and the implementation of advanced technological solutions. The study predicts an increasing reliance on artificial intelligence and machine learning for threat detection, alongside a growing trend of collaboration between SMEs and cybersecurity firms. The research underscores the necessity for supportive policies and frameworks that encourage SMEs to strengthen their cybersecurity posture, recommending financial incentives and the development of SME-specific cybersecurity standards. Building a cyber-secure culture within SMEs, characterized by organizational commitment and regular awareness programs, is identified as crucial for enhancing cyber resilience. Finally, the study emphasizes the importance of cybersecurity for SMEs, offering strategic recommendations for navigating digital threats and suggesting avenues for future research, including the exploration of behavioral aspects of cybersecurity and the impact of emerging technologies.

Cybersecurity compliance in financial institutions: A comparative analysis of global standards and regulations

Cybersecurity is a critical concern for financial institutions worldwide, given the increasing frequency and sophistication of cyberattacks. This paper conducts a comparative analysis of global standards and regulations governing cybersecurity compliance in financial institutions. By examining the regulatory frameworks of key jurisdictions, including the United States, the European Union, and Asia-Pacific countries, this study aims to identify common trends, differences, and best practices in cybersecurity compliance. The analysis begins by outlining the regulatory landscape for cybersecurity in financial institutions, highlighting the key objectives and principles underlying these regulations. It then compares the regulatory frameworks of different regions, focusing on areas such as data protection, incident response, and risk management. By examining the specific requirements and guidelines set forth by each jurisdiction, this study identifies the strengths and weaknesses of current cybersecurity regulations and offers recommendations for enhancing compliance and resilience. One of the key findings of this study is the increasing convergence of global cybersecurity standards, driven by the interconnected nature of the financial sector and the need for harmonized regulatory approaches. While differences in regulatory frameworks still exist, particularly in areas such as data protection and breach notification, there is a growing recognition of the need for international cooperation and information sharing to combat cyber threats effectively. The study also highlights the challenges faced by financial institutions in achieving cybersecurity compliance, including resource constraints, evolving cyber threats, and the complexity of regulatory requirements. It underscores the importance of implementing robust cybersecurity measures, such as encryption, multi-factor authentication, and regular security audits, to mitigate these challenges. In conclusion, this comparative analysis provides valuable insights into the global landscape of cybersecurity compliance in financial institutions. By identifying common trends and best practices, this study aims to assist policymakers, regulators, and financial institutions in enhancing their cybersecurity posture and effectively addressing the evolving cyber threat landscape.

THE SIGNIFICANCE OF LEGAL REGULATION IN ENSURING CYBER SECURITY IN THE CONDITIONS OF WAR: EXPERIENCE FOR UKRAINE

Introduction. In the vast majority of countries, there is a constant trend towards a significant increase in the number and expansion of the spectrum of cyber-attacks with the aim of violating the confidentiality, integrity and availability of state information resources, in particular those distributed on the Internet and objects of critical information infrastructure. Summary of main results. The large-scale deployment of a hybrid war against our state seriously affects all aspects of social life. To a large extent, the strategic success of countering the challenges of hybrid warfare depends on the effective and quality of the legal response. Ensuring an adequate level of cyber security is difficult to imagine without clearly planned joint actions and measures developed by responsible entities, which must be synchronized and implemented according to a single strategic plan and development vector of the national cyber security system of a declarative nature. That is why cyber security in most countries of the world is recognized as an important component of national security, the provision of which is impossible without the formation and functioning of a national system in the field of cyber security, which is based on such principles as respect for the principles and norms of international law, protection of fundamental values defined by current legislation, protection national interests in cyberspace. It is emphasized that the state's national security largely depends on the state of cyber security. It has been proven that hybrid war significantly increases the impact of cyber threats on Ukrainian society and actualizes the danger of targeted cyber attacks as a tool of aggression against our state in the context of global trends regarding threats in cyberspace. Conclusions. In the process of conducting the research, we formulated conclusions in which special attention was paid to the peculiarities of the current state of functioning of the legislation on cyber security and considered promising directions for its improvement in the future, which, in turn, will become the basis for improving the administrative and legal regulation of cyber security in Ukraine.

Implementasi Nilai Nilai Kebangsaan Berbasis NKRI Terhadap Pentingnya Manajemen Security di Era Digitalisasi

The era of digitalization has brought significant changes in various aspects of life, including in security management. The wider application of digital technology requires an adaptive and innovative security approach to deal with evolving threats. In the context of the Unitary State of the Republic of Indonesia (NKRI), the implementation of national values in digital security management is very important. These values include unity, integrity, justice, democracy and diversity, which are the foundations of NKRI. This research aims to analyze the importance of security management in the digitalization era based on the NKRI's national values.The method used in this research is descriptive qualitative, with a literature study approach and document analysis related to digital security policies in Indonesia. The analysis focused on how NKRI national values are implemented in security management strategies and practices to face digital security challenges. The results show that the integration of national values in digital security management plays an important role in strengthening national resilience in the digital space. The implementation of national values helps in building a digital security system that is not only technically robust, but also responsive to Indonesia's social and cultural dynamics. This includes the development of inclusive cybersecurity policies, digital security education for diverse communities, and strengthening collaboration between sectors to strengthen the national digital security ecosystem.

Copyright Protection of Digital Content in Vietnam’s Internet Age

The digital content sector in Vietnam is viewed as a "new gold mine”, with a multi-billion-dollar industry. We look at Vietnam's legislative framework for copyright protection, which includes both Intellectual Property, and Cybersecurity Laws. The paper contends that while technology can help address some of the issues of preserving digital content, it is not a cure-all and must be used together with legal and educational measures. The significance of international cooperation in preserving digital content is highlighted. Finally, this research presents a complete analysis of Vietnam's current legal framework for copyright protection of digital information, as well as an assessment of the obstacles and limitations in enforcing these laws. It further highlights the importance of international collaboration in digital content protection and asks for increased efforts to deepen cooperation in this area, and is aimed at policymakers, legal professionals, and scholars interested in copyright protection and digital material in Vietnam.

European cybersecurity standardisation: a tale of two solitudes in view of Europe’s cyber resilience

Cybersecurity resilience as a concept and EU policy approach encompasses, in broad terms, the preparedness of organisations against and the ability to recover from cyber-attacks. Policy and law makers in the European Union have started endorsing strategies moving both towards reactive measures mitigating the consequences of cybersecurity incidents and proactive measures geared towards prevention. Recently, a political agreement was reached on a new horizontal Regulation addressing cyber resilience of products with digital elements. An essential aspect of the Cyber Resilience Act is technical standardisation to support its goals. How appropriate is however the European Standardisation system for such a role in EU cybersecurity law? The paper argues that for European standards to be conceptualised as a building block of cyber resilience in the European Union, their development process must be inclusive and open, and a prerequisite for that is that the ESOs jointly work towards the common goal of developing and adopting European standards in support of the EU cyber resilience policy and law. This collaborative approach is mandated both by the nature of cyber resilience and cybersecurity as regulated fields, but also the changing nature of standardisation aspiring to contribute to areas pertaining to societal interests and fundamental rights.