Cybersecurity Audit Research Articles

Cyber Fraud, Causes and Its Effect on Money Deposit Banks

The study examined cyber fraud, causes and its effect on money deposit banks (DMB) in Nigeria: a study of Zenith Bank. The main objective is to examine electronic frauds, causes and its challenges in the banking sector. The study is hinged on two hypotheses; 49 branches; sample of 557 staff. Structured questionnaire was used to capture the response of the bank staff and it was analyzed using statistical package for social science version 27 (SPSS). Descriptive statistics and multiple regression were employed in the data analysis. Among the findings were accounting fraud by bank staff, identity theft, money laundering, phishing, pharming, computer virus, lack of oversight function,lack of standards, financial loss, absence of national central control, lack of credible infrastructure, porous internet, lack of national functional database, and inadequate awareness by bank customers were the challenges militating the effort towards curbing the cyber fraud in the banking system in Nigeria. The findings also revealed that cybercrime reduced productivity; vulnerability of banks Information and Communication Technology (ICT) systems and security audit. The study recommends adequate antivirus and antimalware software technology and the use of multi-factor authentication, use of biometrics, automatic logout are the solutions identified to curb cybercrimes in banks. The study concluded that the place of security in the cyber space of banks in Nigeria cannot be oversemphasied, therefore necessary measures should be put in place towards mitigating cybercrime in Zenith Bank. Equally, Zenith Bank should employ stringent measures to monitor staff activities especially in the confidentiality of customer information, cyber security audit should be done on regular basis, sensitization of bank customers, and Multifactor authentication, biometrics and automatic log out, and strong firewall should be adopted by Zenith Bank.

Assessing the Effectiveness of Cyber Domain Controls When Conducting Cybersecurity Audits: Insights from Higher Education Institutions in Canada

This study validates a comprehensive cybersecurity audit model through empirical analysis in three higher education institutions in Canada. The research aims to enhance cybersecurity resilience by assessing the effectiveness of cybersecurity controls across diverse educational environments. Given the increasing frequency and sophistication of cyberattacks targeting educational institutions, this research is essential to ensure the protection of sensitive academic and personal data. Data were collected through detailed audits involving system vulnerabilities, compliance with security policies, and incident response management at each institution. The findings underscore the importance of tailored cybersecurity strategies and continuous auditing to mitigate cyber risks in the Canadian higher education sector. This study contributes to the field by validating a versatile audit tool that can be adapted to various institutional contexts, promoting enhanced cybersecurity practices and evaluating the effectiveness of cybersecurity safeguards across the higher education sector in Canada. The results of the audit model validations provide the cybersecurity maturity rating of each institution. Further research is recommended to refine the model and explore its application in other industries and sectors.

Key drivers of cybersecurity audit effectiveness: A neo‐institutional perspective

The aim of this paper is to analyse which factors explain the effectiveness of internal audit in providing assurance about cybersecurity risk management. On the basis of neo‐institutional theory, we hypothesize that coercive (cybersecurity regulation), normative (professionalization of internal auditors and Boards) and mimetic forces (outsourcing of cyber security assurance services) positively contribute to cybersecurity audit (CSA) effectiveness. As these forces do not come about in an interest free model, we study the role of and the interaction with other actors who shape the CSA practices—Boards and security experts. We hypothesize that Board's support to CSA and the level of internal auditors' cooperation with the first and the second line of defence positively affect CSA effectiveness. To test our hypothesis, we conducted a survey involving IT auditors and Chief Audit Executives from various industries, organizations of different sizes and countries. We examined the hypothesized relationships in a series of regression analyses. We find that normative forces (professionalization of the internal auditors and Boards' competences), Board's support to CSA and cooperation between the internal audit function (IAF) and the first two line of defence significantly explain the CSA effectiveness. We find no support for the effect of regulation as a coercive force and outsourcing as a mimetic force. We discuss potential reasons for our findings and their implications. The paper is an original analysis that advances our understanding of key drivers of CSA effectiveness and their relationships.

Post-Merger Cybersecurity Audits in Healthcare with a Structured Approach

Post-Merger Cybersecurity Audits in Healthcare with a Structured Approach

Review of methodology for conducting cybersecurity audits for compliance with standards

This study focuses on the analysis of conducting cybersecurity audits, providing a generalized view of this process. The main attention is given to analyzing the stages of conducting cybersecurity audits and methods of information collection. Special emphasis is placed on the development and implementation of sensor systems capable of withstanding high pressure and corrosion in underwater environments, as well as providing accurate and reliable data. The work covers theoretical aspects of conducting audits, including defining objectives, scope, and type of audit, planning, evidence collection, and evaluating compliance with cybersecurity standards. This research highlights the importance of corrective actions by the organization after the audit, as without this step, the process is almost entirely meaningless.

Information and cybersecurity audit: Statutory regulation and performance issues

Subject. This article focuses on the issues related to the audit of information systems and cybersecurity. Objectives. The article aims to determine the key areas of legal regulation of information security audit, taking into account the requirements of the time, technical capabilities and digital transformations taking place in society and the global space. Methods. For the study, we used a case study method, analysis, computational and graphical method, data systematization, and the ecosystem approach. Results. The article identifies gaps in the methodological framework and statutory regulation of the audit of information systems, substantiates the need for systematization and further development of the legislative framework for the audit of information security, and identifies the objects of information technologies that require special attention. It proposes to make certain changes to the Federal Law On Auditing regarding the introduction of information security checks of business entities into the list of other services, as well as develop standards for government auditing, which will unify this type of activity. Conclusions and Relevance. The number of cybercrimes is steadily growing, and this is due to both the widespread digitalization of ecosystems and the high level of technical and intellectual training of persons committing fraudulent actions. Ensuring the information security of economic entities and government agencies is impossible without conducting an audit that reduces the risk of cyber threats. The results of the study can be used to develop the regulatory framework for the audit of information systems, as well as for further scientific research and practical application.

Revolutionizing Cybersecurity Audit through Artificial Intelligence Automation: A Comprehensive Exploration

Revolutionizing Cybersecurity Audit through Artificial Intelligence Automation: A Comprehensive Exploration

BEYOND PASS/FAIL: DEVELOPING A QUANTITATIVE FRAMEWORK FOR CYBERSECURITY AUDITS

Cybersecurity audits are vital in today’s digital landscape, yet they come with numerous challenges, such as resource constraints and evolving audit requirements. This article explores the importance of risk quantification in cybersecurity audits, emphasizing its role in aiding decision-making processes and enhancing organizational resilience. Drawing from real-world examples like the 2019 First American Financial Corporation data breach, the article highlights the consequences of unresolved vulnerabilities and the necessity of effective risk communication. By introducing a simplified framework for risk quantification, the article proposes a practical approach that enables auditors to approximate probabilities without complex software tools. Furthermore, it discusses the synergy between risk quantification and compliance efforts, underscoring their collective impact on resource allocation, risk management strategy, and business continuity. Ultimately, the article advocates for a paradigm shift in cybersecurity audits, urging auditors to move beyond traditional pass/fail approaches and embrace quantitative risk assessment methodologies to better safeguard organizations against cyber threats.

Integrating NIST and ISO Cybersecurity Audit and Risk Assessment Frameworks into Cameroonian Law

This paper reviews cybersecurity laws and regulations in Cameroon, focusing on cybersecurity and information security audits and risk assessments. The importance of cybersecurity risk assessment and the implementation of security controls to cure deficiencies noted during risk assessments or audits is a critical step in developing cybersecurity resilience. Cameroon's cybersecurity legal framework provides for audits but does not explicitly enumerate controls. Consequently, integrating relevant controls from the NIST frameworks and ISO Standards can improve the cybersecurity posture in Cameroon while waiting for a comprehensive revision of the legal framework. NIST and ISO are internationally recognized as best practices in information security systems and cybersecurity risk management. This paper highlights the lack of specific international law provisions addressing cybersecurity audits and risk assessments. Overall, the paper highlights the importance of continuous risk assessment and monitoring, implementation of security controls, and compliance with organizational policies, relevant laws and regulations to ensure the adequate protection of information systems. Finally, the paper underscores the importance of improving Cameroon's cybersecurity regulations by integrating provisions from NIST and ISO.

The influence of cyber security on financial fraud in the Nigerian banking industry

The study looked at Financial Institution in Nigeria for how cyber security affects financial fraud in Nigerian banks. The study focused on the following topics: the types of electronic frauds committed in the banking industry, the reasons why cyber fraud occurs in banks, the difficulties in preventing cyber fraud in banks, the impact of cyber fraud on Nigerian banks, and potential solutions for preventing cyber fraud in banks. The two hypotheses that the study is based on. Six Nigeria Banks made up the study's population, which used a survey research design. 557 bank employees were sampled using multistage sampling techniques. The bank staff's responses were gathered using a structured questionnaire, which was then, analyzed using the SPSS statistical package for social science version 27. Descriptive analysis was used to analyze the objectives, and multiple regression and Kendal Tau B were used to test the hypotheses. The study's findings indicated that computer viruses, hacking/cracking, phishing, pharming, and accounting fraud by bank employees were the main types of cyber fraud in the banking system. The causes of cybercrime in banks included a lack of line manager or senior manager oversight on deviations from existing electronic processes or controls, current business pressure to meet set targets, collusion between employees and outside parties, insufficient data encryption, the use of third-party services, and parodying. Similarly, the study's findings showed that the challenges impeding the effort to stop cyber fraud in Nigeria's banking system included a lack of standards and national central control, a lack of infrastructure, the internet's vulnerability, a lack of national functional databases, and inadequate awareness by bank customers. A security audit, antivirus and antimalware software, the use of multi-factor authentication, the use of biometrics, and automatic logout were found to be solutions to cybercrime in banks. The findings also showed that financial loss, decreased productivity, and vulnerability of banks' Information and Communication Technology (ICT) systems and networks were effects of cybercrime on banks in Nigeria. According to the study's findings, banks' cyberspace security cannot be overextended in Nigeria, so necessary precautions should be taken to reduce cybercrime in Nigeria Banks. The study recommended that Nigeria Banks implement stringent measures to monitor staff activities, particularly in the confidentiality of customer information, cyber security audit be performed by financial institution regularly, sensitization of bank customers, and Multi-factor authentication, biometrics and automatic log out, and strong firewall should be adopted by Nigeria Financial Institutions.

Cybersecurity Risks and Its Regulations. The Philosophy of Cybersecurity Audit

Since financial institutions are leading targets of cyber attacks, the article’s main goal is to show that without dedicated action, the global financial system will only become more vulnerable as innovation, competition, and the pandemic further fuel the digital revolution. Also, the cost of cybercrime at financial institutions outpaces the cost of cybercrime in other industries. For example, according to a 2019 private study, the per-company cost of cybercrime is over $18 million for financial services companies, around 40% higher than the average cost for other sectors. If the entire system fails to address cybersecurity concerns adequately, this could lead to systemic risk – the risk that a cybersecurity incident would destabilize the financial system. The article considers the level of protection of confidential information in financial enterprises and the means of combating data leaks. In addition, the question of the need for an information technology audit, especially a cybersecurity audit, is raised.

A study of cybercrime and cybersecurity

At present, millions of people use mobile phones and computers in their daily lives. They are using these devices for online shopping, banking transactions, online gaming, share market, etc. Sometimes people have no knowledge of cybercrime and are easy victims of cyber-related fraud. This paper discusses different types of cybercrime, such as identity theft, cyberstalking, cyberbullying, financial fraud, and the importance of cybersecurity techniques including risk management, internal audit, and the benefits of a cybersecurity audit. The conclusion emphasizes the importance of expanding cybersecurity measures to protect against evolving cyber threats.

Effectiveness of cybersecurity audit

The aim of this paper is to analyze the effectiveness of internal audit of cybersecurity. We developed a Cybersecurity Audit Index composed of three dimensions – planning, performing and reporting – to address this question. We hypothesize that cybersecurity audit effectiveness is positively related to cyber risk management maturity and negatively to the probability of a successful cyber attack. We tested our hypotheses in a survey with auditors and Chief Audit Executives from various countries and industries. We found that Cybersecurity Audit Index scores significantly vary, with a mean of 58 on a scale from 0 to 100. While the planning and performing phases are strongly and positively correlated, they are less strongly related to reporting about cyber risk management effectiveness to the Board of Directors. As predicted, the Cybersecurity Audit Index is positively associated with maturity, but contrary to expectations, it is not related to the probability of a successful cyber attack. This is the first paper that comprehensively measures the effectiveness of cybersecurity audit and its effects on cyber risk management.

THE INFLUENCE OF NLU AND GENERATIVE AI ON THE DEVELOPMENT OF CYBER DEFENSE SYSTEMS

The combination of cyber security systems and artificial intelligence is a logical step at this stage of information technology development. Today, many cybersecurity vendors are incorporating machine learning and artificial intelligence into their products or services. However, the effectiveness of investments in advanced machine learning and deep learning technologies in terms of generating meaningful measurable results from these products is a matter of debate. When designing such systems, there are problems with achieving accuracy and scaling. The article considers the classification of artificial intelligence systems, artificial intelligence models used by security products, their capabilities, recommendations that should be taken into account when using generative artificial intelligence technologies for cyber protection systems are given. ChatGPT's NLP capabilities can be used to simplify the configuration of policies in security products. An approach that considers both short-term and long-term metrics to measure progress, differentiation, and customer value through AI is appropriate. The issue of using generative AI based on platform solutions, which allows aggregating various user data, exchanging ideas and experience among a large community, and processing high-quality telemetry data, is also considered. Thanks to the network effect, there is an opportunity to retrain AI models and improve the effectiveness of cyber defense for all users. These benefits lead to a virtual cycle of increased user engagement and improved cyber security outcomes, making platform-based security solutions an attractive choice for businesses and individuals alike. When conducting a cyber security audit of any IT infrastructure using AI, the limits and depth of the audit are established taking into account previous experience.

Minutes of the Annual Meeting: Friday, 29 January 2021, 4:30 pm EST, Virtual Presentation via Convene

Minutes of the Annual Meeting: Friday, 29 January 2021, 4:30 pm EST, Virtual Presentation via Convene

Emergence of Cyber Security Audit: How Cybersecurity Audit Will Be Helpful For Business in the Age of Digital Transformation

Cybersecurity has become one of the serious challenges faced by every type of organization and society. A cybersecurity audit is a complete evaluation and analysis of the IT infrastructure of a business organization. In protecting businesses in the ongoing battle against cyber threats, the cybersecurity audit plays a vital role. This article explores the new buzzword “cybersecurity audit” and we also attempt to answer how cybersecurity audit will be helpful for business firms in the age of digital transformation.

Cybersecurity audit technology of corporate information system according to ISO / IES: 27001

The problem of cybersecurity of corporate information systems is analyzed in the work and the purpose and tasks of their protection are defined. An analysis of existing technologies for cybersecurity audit of corporate information systems and international standards that describe them. The methods of conducting cybersecurity audit according to the methods of international standards ISO / IEC 27001, ISO / IEC 19011 and COBIT are studied. The types, principles and main stages of cybersecurity audit are identified. On the basis of the researches carried out in the work the variant of technology of carrying out of audit of cybersecurity of corporate information systems by a technique of the international standards is developed. Recommendations for the application of the technology variant of the cybersecurity audit of corporate information systems have been developed.

Key drivers of cybersecurity audit effectiveness: the neo-institutional perspective

We analyze which factors explain the effectiveness of internal audit in providing assurance about cybersecurity risk management. Based on neo-institutional theory, we hypothesize that coercive (cybersecurity regulation), normative (internal auditors' academic background, cybersecurity certifications, and training) and mimetic forces (outsourcing) positively contribute to cybersecurity audit (CSA) effectiveness. We extend the model of isomorphic forces by the Board's support, Board's competencies, and the level of internal auditors’ cooperation with the first and the second line of defense. To test our hypothesis, we conducted a survey involving 183 IT auditors and Chief Audit Executives from various industries, organizations of different sizes, and countries. We examined the relationships between CSA effectiveness and the hypothesized factors in a series of regression analyses and with a machine learning method – LASSO. We find that normative forces (cybersecurity certifications of the internal auditors) and human agency factors significantly explain CSA effectiveness. While regulation is associated with CSA effectiveness indirectly, we find no support for the effect of outsourcing as a mimetic force. The paper is an original analysis that advances our understanding of key drivers of CSA effectiveness and their relationships.

СИСТЕМА РИЗИКІВ ДІЯЛЬНОСТІ КОМЕРЦІЙНИХ БАНКІВ В УМОВАХ ЦИФРОВІЗАЦІЇ

The trend of modern commercial banks is the digitalization of decision-making processes and various operations, which ensures the preservation of the customer base and the expansion of the banking business through new electronic chan-nels and online lending. It is established that innovative banking technologies create new sources of risk and should ensure effective processes of their management and control. The complex of risks of banking activity in the conditions of digitaliza-tion from the standpoint of consumer interests (data confidentiality, data security, termination of certain types of banking services and fraudulent marketing practices, as well as from the standpoint of banks and the banking system) is identified. , increasing the relationship between participants in the banking sector, liquidity risk and volatility of sources of bank financ-ing, compliance risk, financial technology risks, outsourcing risk.Among the most influential in the implementation of digital technologies in the implementation of digital technologies are the following: strategic, operational risks, growing difficulties in complying with compliance requirements and standards, compliance risk, third party risks, cyber and liquidity risks, and related risks using cloud technologies. The main causes of cyber risks for a commercial bank are stated, which can be solved by constantly updating legislation and uniform security standards, increasing itsown bank financing, as well as cultivating a corporate culture in the field of cybersecurity in the bank. These reasons lead to the use of certain elements of controlling and management of a commercial bank, the system of which includes training staff in cybersecurity rules in any format, developing a fraud plan, regular cybersecurity audits, training customers in basic security rules. A critical issue in the management of banking risks in the context of digitalization is the strengthening of legal provisions governing the field of remote banking

How Effective Is Cyber Security Assurance by Internal Auditors?

The aim of this paper is to analyze how effective internal audit of cybersecurity is. We developed a Cybersecurity Audit Index composed of three dimensions (planning, performing and reporting) to address this question. We hypothesize that CSA effectiveness is positively related to cyber risk management maturity and negatively to the probability of a successful cyber attack. We tested our hypotheses in a survey with auditors and Chief Audit Executives from various countries and industries. We found that CSA Index scores significantly vary, with a mean of 58 on a scale from 0 to 100. While planning and performing CSA are strongly and positively correlated, they are less strongly related to reporting about CS risk management effectiveness to the Board of Directors. In line with our hypothesis, the CSA Index is positively associated with CS risk maturity, but contrary to our hypothesis, it is not related to the probability of a cyber attack. This is the first paper that comprehensively measures the effectiveness of cybersecurity audit and its effects on CS risk management.