Cybersecurity Vulnerabilities Research Articles

Cybersecurity Challenges in Industry: Measuring the Challenge Solve Time to Inform Future Challenges

Cybersecurity vulnerabilities in industrial control systems have been steadily increasing over the last few years. One possible way to address this issue is through raising the awareness (through education) of software developers, with the intent to increase software quality and reduce the number of vulnerabilities. CyberSecurity Challenges (CSCs) are a novel serious game genre that aims to raise industrial software developers’ awareness of secure coding, secure coding guidelines, and secure coding best practices. An important industry-specific requirement to consider in designing these kinds of games is related to the whole event’s duration and how much time it takes to solve each challenge individually—the challenge solve time. In this work, we present two different methods to compute the challenge solve time: one method based on data collected from the CSC dashboard and another method based on a challenge heartbeat. The results obtained by both methods are presented; both methods are compared to each other, and the advantages and limitations of each method are discussed. Furthermore, we introduce the notion of a player profile, which is derived from dashboard data. Our results and contributions aim to establish a method to measure the challenge solve time, inform the design of future challenges, and improve coaching during CSC gameplay.

Researcher Perspectives on Ethical Considerations in Adaptive Deep Brain Stimulation Trials.

Interest and investment in closed-loop or adaptive deep brain stimulation (aDBS) systems have quickly expanded due to this neurotechnology’s potential to more safely and effectively treat refractory movement and psychiatric disorders compared to conventional DBS. A large neuroethics literature outlines potential ethical concerns about conventional DBS and aDBS systems. Few studies, however, have examined stakeholder perspectives about ethical issues in aDBS research and other next-generation DBS devices. To help fill this gap, we conducted semi-structured interviews with researchers involved in aDBS trials (n = 23) to gain insight into the most pressing ethical questions in aDBS research and any concerns about specific features of aDBS devices, including devices’ ability to measure brain activity, automatically adjust stimulation, and store neural data. Using thematic content analysis, we identified 8 central themes in researcher responses. The need to measure and store neural data for aDBS raised concerns among researchers about data privacy and security issues (noted by 91% of researchers), including the avoidance of unintended or unwanted third-party access to data. Researchers reflected on the risks and safety (83%) of aDBS due to the experimental nature of automatically modulating then observing stimulation effects outside a controlled clinical setting and in relation to need for surgical battery changes. Researchers also stressed the importance of ensuring informed consent and adequate patient understanding (74%). Concerns related to automaticity and device programming (65%) were discussed, including current uncertainties about biomarker validity. Additionally, researchers discussed the potential impacts of automatic stimulation on patients’ autonomy and control over stimulation (57%). Lastly, researchers discussed concerns related to patient selection (defining criteria for candidacy) (39%), challenges of ensuring post-trial access to care and device maintenance (39%), and potential effects on personality and identity (30%). To help address researcher concerns, we discuss the need to minimize cybersecurity vulnerabilities, advance biomarker validity, promote the balance of device control between patients and clinicians, and enhance ongoing informed consent. The findings from this study will help inform policies that will maximize the benefits and minimize potential harms of aDBS and other next-generation DBS devices.

Cybersecurity Resiliency of Marine Renewable Energy Systems‐Part 1: Identifying Cybersecurity Vulnerabilities and Determining Risk

AbstractTechnology innovation, market demand, and the potential impacts of a changing climate are driving the marine renewable energy (MRE) industry to develop market-ready systems to provide low-carbon electricity for emerging, off-grid markets. The advanced operational and information technology devices used in MRE systems create a pathway for a cyber threat actor to gain unauthorized access to data or disrupt operation. To improve the resiliency of MRE systems as a predictable, affordable, and reliable source of energy from oceans and rivers, guidance was developed for an end users' organization that describes a framework for identifying and managing cybersecurity risk. The development of the cybersecurity guidance is based on standards described in the Risk Management Framework and Cybersecurity Framework developed by the National Institute of Standards and Technology (NIST). This paper is the first of a two-part series that describes an approach to determine the cybersecurity risk for MRE systems based on assessing potential cyber threats, identifying vulnerabilities (people, processes, and technology, including physical and operational environment), and evaluating the consequences a cyberattack would have on operation of the MRE system and impact on end users' mission and business objectives. MRE developers and stakeholders can use this approach to assess their current cybersecurity risk posture to incorporate appropriate cybersecurity controls to reduce the consequences and impacts from a cyberattack on MRE systems. This approach can be refined further as MRE systems are deployed and operational configurations are available.

Legal and human rights issues of AI: Gaps, challenges and vulnerabilities

This article focusses on legal and human rights issues of artificial intelligence (AI) being discussed and debated, how they are being addressed, gaps and challenges, and affected human rights principles. Such issues include: algorithmic transparency, cybersecurity vulnerabilities, unfairness, bias and discrimination, lack of contestability, legal personhood issues, intellectual property issues, adverse effects on workers, privacy and data protection issues, liability for damage and lack of accountability. The article uses the frame of ‘vulnerability’ to consolidate the understanding of critical areas of concern and guide risk and impact mitigation efforts to protect human well-being. While recognising the good work carried out in the AI law space, and acknowledging this area needs constant evaluation and agility in approach, this article advances the discussion, which is important given the gravity of the impacts of AI technologies, particularly on vulnerable individuals and groups, and their human rights.

Supply Chain Risks in Cybersecurity

Covid-19 has highlighted the fragility of supply chains in a range of critical infrastructure: food, medicines, health care, information technology, communications, and more. This paper focuses on an under-appreciated supply chain risk—network cybersecurity—that was present before the pandemic and which the pandemic brings into sharper focus. While the proliferation of digital services has created significant value and employment opportunities, it has also created a wide array of new cybersecurity vulnerabilities. Vulnerabilities of DVRs, CCTVs, voting machines, and municipal systems, leading to denial of service attacks and ransomware hold ups are known. But, these examples miss a problem. Although these examples give the impression that only certain hardware and specific entities are affected, taking networked cybersecurity into account changes yields different conclusions. For example, given that enterprise software, which is common for work at home situations, is rapidly becoming a cybersecurity vulnerability, anyone connected by this software necessarily becomes a target too. Malicious cyber incidents, like data breaches, can have ripple effects across a network of businesses and sectors. Current definitions and regulations of Critical Infrastructure (CI) overlook this point. We argue that the network dimension of cybersecurity supply chain risk is an important, under-studied aspect of the problem. Legal definitions of CI and the voluntary nature of cybersecurity governance leave gaps in the classification of CI and how to identify cybersecurity risk, particularly in the professional services sector. In addition, the voluntary nature of cybersecurity governance demands risk-based and objective measures to aid in identifying when to take steps on improving cybersecurity, but exactly what such metrics are is, at best, evolving. We address both these problems. By drawing on a new dataset, we develop metrics that measure productivity effects and that captures network cybersecurity risk. This approach allows us to show that a major sector, professional services, is missed by current definitions of critical infrastructure, but could be captured if CI definitions accounted for networked cybersecurity risk. In addition, the approach aids voluntary participation in mitigating cybersecurity risk because it provides a way for any firm or sector to identify and assess the nature of its networked cybersecurity risk. In short, networked cybersecurity vulnerabilities can adversely affect aggregate growth and national security objectives because of connectivity across firms and sectors. This work seeks to provide a path forward for understanding, defining, and protecting networked cybersecurity.

A South African Legal Perspective on the Regulation of Net Neutrality and Its Implications for Cyber-Security and Cyber-Warfare

With the approval of Articles 11 and 13 in Europe, net neutrality has become a contentious issue globally. These articles refer to European Union (EU) copyright law, which could possibly destroy the freedom of the internet that once existed. Throughout Europe it has become known as the “meme ban,” referring to the censorship elements. While there is much opposition to these articles, its supporters consider it necessary for the preservation for creative works online. Opposition to the legislation, which includes certain websites and internet presences, remains of the opinion that these two pieces of legislation will mean an end to “meme culture and user-generated content.” Along with the limitation to the freedom of the internet, cyber-security and cyber-warfare risks and vulnerabilities are imminent. This paper seeks to provide an in-depth discussion on the implications of neutrality on cyber-security and cyber-warfare.

IACAP

With the expansion and development of the internet protocol, the number of cybersecurity vulnerabilities has also increased. However, it is difficult to find a reliable way to detect the vulnerability in the internet-exposed asset. This paper proposes a new design of analysis platform that integrates the cybersecurity data and an internet-exposed asset search engine. Based on this design, it provides a convenient and up-to-date solution for the users to detect the devices' vulnerability crossing internet. Meanwhile, this platform offers suggestions in terms of resolving the cybersecurity problem.

Cybersecurity Vulnerabilities in Mobile Fare Payment Applications: A Case Study

Mobile fare payment applications are becoming increasingly common in the public transportation industry as a convenience for customers and as part of an effort to reduce fare management costs and improve operations for agencies. However, there is relatively little literature on vulnerabilities and liabilities in mobile fare payment applications. Furthermore, few public agencies or supporting vendors have policies or established processes in place to receive vulnerability reports or patch vulnerabilities discovered in their technologies. Given the rapidly increasing number of data breaches in general industry IT systems, as well as that mobile fare payment apps are a nexus between customer and agency financial information, the security of these mobile applications deserves further scrutiny. This paper presents a vulnerability discovered in a mobile fare payment application deployed at a transit agency in Florida that, because of the system architecture, may have affected customers in as many as 40 cities across the United States, an estimated 1,554,000 users. Lessons learned from the vulnerability disclosure process followed by the research team as well as recommendations for public agencies seeking to improve the security of these types of applications are also discussed.

Towards a Severity Assessment Method for Potential Cyber Attacks to Connected and Autonomous Vehicles

CAV (connected and autonomous vehicle) is a crucial part of intelligent transportation systems. CAVs utilize both sensors and communication components to make driving decisions. A large number of companies, research organizations, and governments have researched extensively on the development of CAVs. The increasing number of autonomous and connected functions however means that CAVs are exposed to more cyber security vulnerabilities. Unlike computer cyber security attacks, cyber attacks to CAVs could lead to not only information leakage but also physical damage. According to the UK CAV Cyber Security Principles, preventing CAVs from cyber security attacks need to be considered at the beginning of CAV development. In this paper, a large set of potential cyber attacks are collected and investigated from the aspects of target assets, risks, and consequences. Severity of each type of attacks is then analysed based on clearly defined new set of criteria. The levels of severity for the attacks can be categorized as critical, important, moderate, and minor. Mitigation methods including prevention, reduction, transference, acceptance, and contingency are then suggested. It is found that remote control, fake vision on cameras, hidden objects to LiDAR and Radar, spoofing attack to GNSS, and fake identity in cloud authority are the most dangerous and of the highest vulnerabilities in CAV cyber security.

Anomaly detection in substation networks

Fundamental components of the distribution systems of electric energy are primary and secondary substation networks. Considering the incorporation of legacy communication infrastructure in these systems, they often have in- herent cybersecurity vulnerabilities. Moreover, traditional intrusion defence strategies for IT systems are often not applicable. With the aim to improve cybersecurity in substation networks, in this paper we present two methods for monitoring SCADA system: the first one exploiting neural networks, while the second one is based on formal methods. To evaluate the effective- ness of the proposed methods, we conducted experiments on a real test bed representing the substation domain as close to real-world as possible. From this test bed we collect data during normal operation and during situations where the system is under attack. To this end several different types of attack are conducted. The data collected is used to test two versions of the mon- itoring system: one based on machine learning with a neural network and one using a model-checking approach. Moreover, the two proposed models are tested with new data to evaluate their performance. The experiments demonstrate that both methods obtain an accuracy greater than 90%. In particular, the methodology based on formal methods achieves better per- formance if compared to the one based on neural networks.

AI-Driven Cybersecurity Threats to Future Networks [From the Guest Editors

The articles in this special section focus on artificial intelligence-driven cybersecurity threats to future networks. Future-generation networks (5G and beyond 5G) will include a variety of services for various verticals, such as enhanced mobile broadband, health monitoring, Industry 4.0, smart energy distribution, and automotive networks. These vertical services and the critical components that comprise 5G architecture (e.g., radio access and edge and core networks) exhibit several cybersecurity vulnerabilities that attract attackers to use all their capabilities to exploit and hence shut down these networks. Recently, a new generation of smart threats, defined as artificial intelligence (AI ) attacks, has appeared. These smart attacks either turn AI into weapons to attack 5G services or hack the AI algorithms used by 5G components. In the first misbehavior, attackers take advantage of AI’s improved ability to launch lethal and stealthy threats against attractive targets, e.g., autonomous vehicles, drones, or manufacturing machinery. In the second misbehavior, attackers hack machine learning (ML) algorithms by modifying, for instance, the labels of the ML classification functions and altering the training data, causing a decrease in the accuracy of the classification rate.

Remote monitoring of cardiac implanted electronic devices: legal requirements and ethical principles - ESC Regulatory Affairs Committee/EHRA joint task force report.

The European Union (EU) General Data Protection Regulation (GDPR) imposes legal responsibilities concerning the collection and processing of personal information from individuals who live in the EU. It has particular implications for the remote monitoring of cardiac implantable electronic devices (CIEDs). This report from a joint Task Force of the European Heart Rhythm Association and the Regulatory Affairs Committee of the European Society of Cardiology (ESC) recommends a common legal interpretation of the GDPR. Manufacturers and hospitals should be designated as joint controllers of the data collected by remote monitoring (depending upon the system architecture) and they should have a mutual contract in place that defines their respective roles; a generic template is proposed. Alternatively, they may be two independent controllers. Self-employed cardiologists also are data controllers. Third-party providers of monitoring platforms may act as data processors. Manufacturers should always collect and process the minimum amount of identifiable data necessary, and wherever feasible have access only to pseudonymized data. Cybersecurity vulnerabilities have been reported concerning the security of transmission of data between a patient's device and the transceiver, so manufacturers should use secure communication protocols. Patients need to be informed how their remotely monitored data will be handled and used, and their informed consent should be sought before their device is implanted. Review of consent forms in current use revealed great variability in length and content, and sometimes very technical language; therefore, a standard information sheet and generic consent form are proposed. Cardiologists who care for patients with CIEDs that are remotely monitored should be aware of these issues.

Analogical reasoning in uncovering the meaning of digital-technology terms: the case of backdoor

<p>The paper substantiates the critical role of analogical reasoning and figurative languge in resolving the ambiguity of cybersecurity terms in various expert communities. Dwelling on the divergent interpretations of a backdoor, it uncovers the potential of metaphor to serve both as an interpretative mechanism and as a framing tool in the ongoing digital technologies discourse. By combining methods of corpus research and frame semantics analysis the study examines the challenges of unpacking the meaning of the contested concept of the backdoor. The paper proposes a qualitatively new metaphor-facilitated mode of interpreting cybersecurity vulnerabilities based on MetaNet deep semantic metaphor analysis and outlines the merits of this hierarchically organized metaphor and frames ontology. The utility of the method is demonstrated through analyzing corpus data and top-down extracting of metaphors (linguistic metaphor – conceptual metaphor – entailed metaphor – inferences) with subsequent identifying of metaphor families dominating the cybersecurity discourse. The paper further claims that the predominant metaphors prompt certain decisions and solutions affecting information security policies. </p>

Cyber security vulnerabilities for outdoor vehicular visible light communication in secure platoon network: Review, power distribution, and signal to noise ratio analysis

Light Fidelity (LiFi), a 5th Generation visible light communication (VLC) technology, is anticipated to be utilized in various locations where radio frequency (RF) cannot be deployed, due to RF health limitations and congestion. VLC offers a robust communication link for Vehicular Ad Hoc Networks (VANETs), where cars interact wirelessly to enhance the traffic flow and road safety. Thus VLC has been considered as a complementary approach to RF in Vehicle-to-vehicle (V2V) communication, for its potential to mitigate security vulnerabilities caused in RF V2V communication by using light directivity and impermeability. V2V VLC privacy and security are fields that have been hardly examined. In this study, we work on multiple VLC challenges and motivation especially for the security performance of the physical layer of a V2V VLC-based protocol. We introduce an improved V2V VLC proposed model and define a security protocol to enhance received power distribution and secrecy performance. We followed a two-step process to achieve this aim, first decrease the LED semi-angle then apply the protected zone between the legitimate vehicles where adversaries are banned. The simulation results, measuring the received optical power, SNR and BER, show that V2V VLC received power and secrecy performance are improved by using the proposed model.

Cybersecurity and cardiac implantable electronic devices.

Cybersecurity vulnerabilities of cardiac implantable electronic devices have been an area of increasing concern in the past 4 years. Physicians should be informed of these issues as they evolve so they can counsel their patients with the most accurate and up-to-date information.

Blockchain Approach to Cyber Security Vulnerabilities Attacks and Potential Countermeasures

Blockchain Approach to Cyber Security Vulnerabilities Attacks and Potential Countermeasures

Hijacking internet‐connected devices to provoke harmful oscillations in an electrical network: a feasibility assessment

Internet-connected devices will represent an increasing proportion of the load served by electric power systems. As these devices could conceivably be hijacked and controlled remotely by a malicious actor, they could represent a new threat vector against the dynamic security of a power system. Such attack strategies have not been considered in the existing literature on power system cybersecurity. As an initial scoping exercise, the present case study explores whether such devices could be remotely hijacked and then maliciously power-cycled at particular frequencies to deliberately provoke harmful oscillations in an electrical grid. To gauge the broad feasibility of this novel style of attack, dynamic simulations are performed on two representative test power systems, at differing levels of attacker and defender resources. These simulations show that power-cycling just 1% of consumer loads at a system's resonant frequency may sometimes provoke harmful electromechanical oscillations throughout a national grid. This novel simulation exercise, therefore, implies that cybersecurity vulnerabilities at the consumer side could jeopardise the physical integrity of a nation's entire electricity supply.

A Scalable FMI-Compatible Cosimulation Platform for Synchrophasor Network Studies

Rigorous evaluation of a synchrophasor network in terms of communication network quality, cybersecurity, and phasor data concentrator (PDC) performance is presented. To this aim, a cosimulation platform is designed based on the multiagent environment for complex system cosimulation platform. The proposed platform is characterized by particular features including scalability (no limitation in terms of nodes/buses of communication/power systems), compatibility with the functional mock-up interface standard, and capability of synchronized integration of any two abstract simulators (in this article, NS-3 for communication network and MATLAB/Simulink for power system). The simulations are performed for the detailed model of the IEEE-34 bus distribution network including phasor measurement units and the PDC. The simulations include (1) evaluation of widely used synchrophasor communication technologies (i.e., user datagram protocol and transmission control protocol), (2) evaluation of the PDC performance under both relative and absolute wait time logics, and (3) assessment of cybersecurity vulnerabilities of the synchrophasor network. The proposed platform can be utilized for implementation and evaluation of communication technologies/protocols of synchrophasor networks in terms of bandwidth, packet missing, latency, and cybersecurity vulnerabilities. Data pushing mechanism of the PDC can be also evaluated using the proposed platform.

Cyber security threats in the microbial genomics era: implications for public health.

Next generation sequencing (NGS) is becoming the new gold standard in public health microbiology. Like any disruptive technology, its growing popularity inevitably attracts cyber security actors, for whom the health sector is attractive because it combines mission-critical infrastructure and high-value data with cybersecurity vulnerabilities. In this Perspective, we explore cyber security aspects of microbial NGS. We discuss the motivations and objectives for such attack, its feasibility and implications, and highlight policy considerations aimed at threat mitigation. Particular focus is placed on the attack vectors, where the entire process of NGS, from sample to result, could be vulnerable, and a risk assessment based on probability and impact for representative attack vectors is presented. Cyber attacks on microbial NGS could result in loss of confidentiality (leakage of personal or institutional data), integrity (misdetection of pathogens) and availability (denial of sequencing services). NGS platforms are also at risk of being used as propagation vectors, compromising an entire system or network. Owing to the rapid evolution of microbial NGS and its applications, and in light of the dynamics of the cyber security domain, frequent risk assessments should be carried out in order to identify new threats and underpin constantly updated public health policies.

FDA Warns of Urgent Cybersecurity Vulnerabilities With Medical Devices

FDA Warns of Urgent Cybersecurity Vulnerabilities With Medical Devices