Critical Infrastructure Cybersecurity Research Articles

Cybersecurity in Critical Infrastructure: Defending Against Nation-State Groups

Cyber-attacks on critical infrastructure can be disastrous and undermine states' national security. Different groups execute these attacks for varying reasons; some may be state-sponsored, and their attack for geopolitical reasons or to achieve strategic national cyber objectives. Regardless of the nation-state actor, it is essential to identify the techniques used and defend critical infrastructure against these attacks. This study evaluated the attack methodology of five nation-state actors based on the MITRE ATT&CK ICS matrix and proposed a multi-layered defense architecture. A virtual organization with critical and enterprise infrastructure domains was created, and the proposed defense architecture and tooling were implemented there. Then, techniques of the nation-state adversaries were emulated against the infrastructure to evaluate the performance of the defense strategies. The results show that the multi-layered approach was sufficient to mitigate all the techniques of the nation-state actors.

A Quantum-Safe Software-Defined Deterministic Internet of Things (IoT) with Hardware-Enforced Cyber-Security for Critical Infrastructures

The next-generation “Industrial Internet of Things” (IIoT) will support “Machine-to-Machine” (M2M) communications for smart Cyber-Physical-Systems and Industry 4.0, and require guaranteed cyber-security. This paper explores hardware-enforced cyber-security for critical infrastructures. It examines a quantum-safe “Software-Defined-Deterministic IIoT” (SDD-IIoT), with a new forwarding-plane (sub-layer-3a) for deterministic M2M traffic flows. A “Software-Defined Networking” (SDN) control plane controls many “Software-Defined-Deterministic Wide-Area Networks” (SDD-WANs), realized with FPGAs. The SDN control plane provides an “Admission-Control/Access-Control” system for network-bandwidth, using collaborating Artificial Intelligence (AI)-based “Zero Trust Architectures” (ZTAs). Hardware-enforced access-control eliminates all congestion, BufferBloat, and DoS/DDoS attacks, significantly reduces buffer-sizes, and supports ultra-reliable-low-latency communications in the forwarding-plane. The forwarding-plane can: (i) Encrypt/Authenticate M2M flows using quantum-safe ciphers, to withstand attacks by Quantum Computers; (ii) Implement “guaranteed intrusion detection systems” in FPGAs, to detect cyber-attacks embedded within billions of IIoT packets; (iii) Provide guaranteed immunity to external cyber-attacks, and exceptionally strong immunity to internal cyber-attacks; (iv) Save USD 100s of billions annually by exploiting FPGAs; and (v) Enable hybrid Classical-Quantum networks, by integrating a “quantum key distribution” (QKD) network with a classical forwarding plane with exceptionally strong cyber-security, determined by the computational hardness of cracking Symmetric Key Cryptography. Extensive experimental results for an SDD-WAN over the European Union are reported.

EMERGING TRENDS IN CYBERSECURITY FOR CRITICAL INFRASTRUCTURE PROTECTION: A COMPREHENSIVE REVIEW

As critical infrastructure becomes increasingly interconnected and digitized, the need for robust cybersecurity measures to safeguard essential systems is more pressing than ever. This review article explores the dynamic landscape of cybersecurity for critical infrastructure, focusing on emerging trends, current challenges, and future prospects. The historical overview delves into the evolution of cyber threats, emphasizing the need for adaptive security measures. Key components of critical infrastructure are examined, elucidating the specific challenges each sector faces. The current state of critical infrastructure cybersecurity is analyzed, with a spotlight on frameworks that guide organizations in bolstering their defenses. The heart of the review explores emerging trends in cybersecurity, covering artificial intelligence and machine learning for threat detection, IoT security, blockchain applications, and advancements in cloud computing security. Challenges and threats on the horizon, including advanced persistent threats and quantum computing implications, are scrutinized to provide insights into potential vulnerabilities.
 Keywords: Cybersecurity; Critical Infrastructure; Artificial Intelligence; Internet-of-Things; Blockchain.

Cyber Security for Critical Infrastructures of a Nation

Cyber Security for Critical Infrastructures of a Nation

Application of Sentiment Analysis to Prevent Cyberattacks on Objects of Critical Information Infrastructure

The article addresses the pressing issue of ensuring cyber security for critical information infrastructure, which is associated with the development of modern information technologies and the increased potential for cyber attacks from criminal groups and potential adversary state entities. An analysis of the scientific literature indicates the necessity of preventive measures and scientific research, which involve monitoring the cyberspace. The application of sentiment analysis is proposed to detect the emotional sentiment towards critical information infrastructure objects. Following a defined algorithm, a sentiment analysis model is constructed based on an artificial neural network using open-source Python programming language libraries. The model's distinguishing feature is the consideration of emoticons to determine the intensification of emotional attitudes towards conducting cyber attacks on critical information infrastructure objects. A dataset related to cyber attacks from social media platforms such as Twitter and Instagram is collected to train the neural network. The results of training and testing the neural network provide grounds to assert that the network's accuracy of 0.7852 is relatively high, enabling its application by cyber reconnaissance units for early detection of cyber threats to critical infrastructure objects in combination with other tools.

Layered structures of robustness and resilience: Evidence from cybersecurity projects for critical infrastructures in Central Europe

AbstractThe article studies cybersecurity projects from the perspective of social systems theory. Measures taken to increase cybersecurity are aimed at the robustness and resilience of specific systemic entities in society. We argue that this does not necessarily mean that systems in which these entities are embedded become more robust or resilient. The article investigates the objectives of 20 projects funded by different public organizations to increase cybersecurity of critical infrastructures. The findings show that robustness and resilience are addressed by these projects on different layers of systems in society, without a clear picture of how they are supposed to fit together in a wider effort to protect society against disruption. The detailed analysis of the different facets of robustness and resilience addressed in cybersecurity projects paves the way for a better understanding of this problem. The research shows how organizations may avoid the negative consequences of measures to secure specific systemic entities in society in the case of critical infrastructures, other application scenarios, and digital innovation in general.

Problems and Prospects of Implementing Assessment of the Level of Maturity of Cyber Security Processes of Critical Infrastructure Objects of the Energy Sector of Ukraine in Accordance with the NIST Cybersecurity Framework

Existing problems regarding compliance with requirements in the field of cyber security of Ukraine's critical infrastructure in the energy sector, prospects for the implementation of the NIST Cybersecurity Framework and ways to solve the identified problems are described. The Ukrainian legislative framework was analyzed and compared with European and American practices, and the issue of compliance with the requirements of the legislation of various jurisdictions was determined.

Cyberterrorism and Self-Defense in the Framework of International Law

Objective: The problem of international electronic terrorism has spread rapidly and affecting nations adversely. However, International Law continues to view the crimes of international terrorism through the Internet and global cyberattacks as ordinary conventional crimes. This perception created an international legal vacuum. Hence, the existence of this legal vacuum in international law to criminalize these acts, which harm the security and sovereignty of states and affect global peace and security, needs to be addressed. Specifically, the study is aimed at answering the following questions: In the event of armed Cyberterrorism, does International law justifies legitimate self-defense? What are the lacunas Regarding Cyberterrorism in International law?
 
 Methods: This study used an empirical approach. An analysis is made in determining whether cyberattacks may be regarded as an armed assault legitimizing the victim states' right to self-defense. Relevant legal text and resources were pulled together to achieve the aim of this research. Hence, a qualitative descriptive analysis of related legal texts and other relevant documents has been conducted.
 
 Results:The research finds that cyberattack is similar to terrorist attack but the medium of the attack is carried out in cyber is on the computer via the internet while the conventional terrorist attack is physically carried out between or among terrorist members and government troops. However, in the cyberattack, the attacker and his location are not known. The international community has not been able to incorporate cyberattack law into International law because there is no consensus from member states on cyberattacks. Shortly, a coordinated cyberattack carried out through the Internet could cause catastrophic destruction to nations that depend on the Internet, particularly in crucial target areas such as transportation, power supply, and telecommunication infrastructures. Consequently, it has been pointed out that cyber warfare operations can fall under the scope of the international crime of aggression.
 
 Conclusion: An existing legal literature on cyberspace terrorism is exposing a conundrum. There are possible avenues for international legal action relating to terrorism. Still, because these attacks have not occurred, states lack opportunities to improve the impact that international law can make proactively. Options, especially enhancing cybersecurity in critical infrastructure, have appeal because they are strategies against cyber intrusions that are 'all hazards.' By comparison, there is a lack of reliable solutions for foreign legal activities related to the terrorist use of the Internet and social media. At the same time, this issue has become a concern, and there are opportunities for governments, businesses, and civil societies to mitigate it. This challenging background, which shows no signs of fading, may increase interest in integrating offensive cyberattacks into counter-cyber-facilitated terrorism strategies.

A Comparative Study of EU and US Regulatory Approaches to Cybersecurity in Space

This article addresses a need for enhanced transatlantic cooperation and coordination between the European Union (EU) and the United States (US) to prevent, detect, and respond to malicious cyber activities and the need for legislation to ensure that critical infrastructure is secure and resilient. It examines the cybersecurity of space critical infrastructure based on three pillars: cyber resilience, stable cyberspace, and cyber capacity building, and argues that to build up these pillars, the EU and US must have a shared assessment of space security challenges, a sound evaluation of the current strengths and gaps in both regulatory models, and an understanding of the driving factors to legislative change in the two systems. Although both frameworks converge on the importance of risk assessment as being at the heart of effective cybersecurity, this article underscores that neither model is equipped to cover the entire production value chain of space assets. In light of these findings, this article provides several recommendations for how the frameworks can become more resilient, including, inter alia, using public-private partnerships to develop tailored regulations compatible with existing cyber regimes and ensuring that such regulations are specifically designed to improve the cybersecurity of space infrastructure. Cybersecurity, cyberspace, resilience, legislation, critical infrastructure, space assets, public-private partnerships

СТРУКТУРА ДЕЙСТВУЮЩИХ НОРМАТИВНЫХ ПРАВОВЫХ АКТОВ В ОБЛАСТИ ОБЕСПЕЧЕНИЯ БЕЗОПАСНОСТИ ОБЪЕКТОВ КРИТИЧЕСКОЙ ИНФОРМАЦИОННОЙ ИНФРАСТРУКТУРЫ РОССИЙСКОЙ ФЕДЕРАЦИИ

СТРУКТУРА ДЕЙСТВУЮЩИХ НОРМАТИВНЫХ ПРАВОВЫХ АКТОВ В ОБЛАСТИ ОБЕСПЕЧЕНИЯ БЕЗОПАСНОСТИ ОБЪЕКТОВ КРИТИЧЕСКОЙ ИНФОРМАЦИОННОЙ ИНФРАСТРУКТУРЫ РОССИЙСКОЙ ФЕДЕРАЦИИ

The political-legal framework of the Republic of Moldova regarding the digitalization of public services

Moldova’s commitment to digital transformation has become increasingly clear and has accelerated both at the policy and implementation levels. In the context of the war in Ukraine, supporting and strengthening elements of the country’s digital system, such as cyber security of critical infrastructure, media literacy of citizens, and enabling environment for IT business become an imperative of the hour. Digital literacy is a clear priority of the policy of the Republic of Moldova. In order to secure services, but also in order to harmonize with the requirements and standards of the European Union (EU), the Government has introduced measures to implement some policies and strategies regarding the digitization of services. This was due to the presence of a fragmented cyber security system, a small number of cyber security cadres, but also due to weak government technical capacity. This article highlights the main actions undertaken by the country’s leadership in order to digitize public services. Also, this article highlights the gaps faced by the Republic of Moldova in the context of the digitalization of public services.

Cyber security of critical infrastructure during cyber warfare

The concepts and characteristics of critical infrastructure are defined. The role and place of critical infrastructure in the structure of national security of Ukraine is highlighted. The factors that affect the security of critical infrastructure are detailed. The principles of state policy in the field of cyber security of critical infrastructure are outlined. The threats that affect the security of critical infrastructure in the conditions of cyber warfare have been identified. The expediency of conducting periodic reviews of the state of cyber security of critical infrastructure of strategic sectors of the economy is substantiated. The ways and directions of ensuring the safety of critical infrastructure at the state level have been determined. The list of sectoral objects of critical infrastructure is detailed and the sectoral cyber security requirements for such objects are defined. The system of measures aimed at strengthening the protection of critical infrastructure against cyberattacks by the Russian occupiers is summarized. The role and tasks of the domestic special service in the field of counter-intelligence protection of critical infrastructure are revealed. A fragmentary review of domestic legislation devoted to strengthening the protection of critical infrastructure was conducted. The directions of improvements of the domestic legislation in order tostrengthen the state of ensuring cyber security of critical infrastructure under the conditions of themartial law have been determined.

Множество вариантов решений для задачи выбора мер защиты объектов критической информационной инфраструктуры

Cybersecurity of critical information infrastructure is achieved by developing an information security system. It includes organizational and technical measures. The complexity in its development is not only the choice of information security measures (it depends on many criteria), but also the compilation of a set of all options suitable for solving this problem, especially if the object of critical information infrastructure is a state (municipal) information system or a personal data information system. In this paper, a comparative analysis of all possible protection measures is carried out to obtain a consolidated set of options.

AN INTEGRATED APPROACH TO CYBERSECURITY AND CYBERCRIME INVESTIGATION OF CRITICAL INFRASTRUCTURE THROUGH A RANSOMWARE INCIDENT MONITORING SYSTEM

In today's rapidly growing digitalised world, cybersecurity is becoming increasingly important in protecting national security, the economy and public welfare. Critical infrastructure, such as energy, transport, financial services and healthcare, is particularly vulnerable to cybersecurity threats, including ransomware. Our proposed integrated approach to strengthening cybersecurity and investigating cybercrime in these sectors emphasises the importance of an incident monitoring system. It relies on three key pillars: the development of advanced monitoring systems that incorporate artificial intelligence to rapidly detect and analyse threats; in-depth comprehensive risk assessments to identify potential vulnerabilities; and active interagency cooperation for coordinated incident response. A detailed look at the technical aspects of the monitoring system, including its architecture and machine learning algorithms, highlights its ability to predict and detect cyber threats in real time. It also discusses the legal and ethical dimensions of data collection and processing, which are critical to ensuring privacy and trust. By analysing real-life cases, we demonstrate how an integrated approach can significantly improve cybersecurity by ensuring effective detection, rapid response and neutralisation of cyber threats. Special attention is paid to successful cases of detecting and blocking attacks, which emphasises the importance of a comprehensive approach to protecting critical infrastructure. In the final part of the article, we consider the prospects for the development of critical infrastructure cybersecurity, focusing on the need for continuous technology upgrades, improved risk assessment methods, and expanded interagency and international cooperation. The importance of adapting to the changing cyber landscape and implementing innovative solutions to strengthen resilience in the face of emerging threats is emphasised. This article makes a significant contribution to the development of integrated cybersecurity strategies, emphasising that the combination of advanced monitoring technologies, in-depth risk assessment and strong interagency cooperation can significantly increase society's ability to effectively counter cyber threats and ensure the security of critical infrastructure.

Impact of cyberspace on the cybersecurity of critical national assets infrastructures in Nigeria: A review of education and financial sectors

Impact of cyberspace on the cybersecurity of critical national assets infrastructures in Nigeria: A review of education and financial sectors

Impact of cyberspace on the cybersecurity of critical national assets infrastructures in Nigeria: A review of education and financial sectors

Unprepared with a fragile digital infrastructures, and hurriedly tossed into the depth of the cyberspace in the Fourth and Fifth Industrial Revolutions (4IR and 5IR) by Covid-19 pandemic measures, of lockdown and needs for remote learning. The educational sector became the most vulnerable; with streams of cyber-attacks stalling virtual classes and compromising data integrity, of which the financial sector was not exempted, despite the evolvement of cyber insurance policy. The financial end users are aggravated and left at the mercy of internet fraudsters called “yahoo-yahoo” boys, coupled with hacking of SWIFT, crypto currency thefts, and Nations’ Central Banks falling into cyber-attacks, thus leaving no unconquered space for cybercriminals, even as cyber literacy and security are siloed away under stand-alone arrangements despite the interconnectedness of the cyberspace. It was against this background, that this study leverages on Theory of Endogenous Growth Model to interrogate impact of cyberspace on the protection of critical national assets and infrastructures in Nigeria. The study deconstruct national assets into education and financial sectors to assess the existing impact. This study adopts qualitative research design using exploratory research design of publicly available archive documents. Empirical evidence from study revealed that cyberspace has expanded the virtual learning horizon while cyber attacks still remain on the minimal. Findings that emanate from this study revealed cyberspace has positively impacted on the Nigeria Financial sector through financial inclusion and transaction conveniences while the damaging effect of cyberattacks remained largely covered up. The study recommends that all players in the educational sector should invest widely in cybersecurity as days of imminent cyberattacks is on the horizon as seen evolving in developed clime. Study also recommend that government should firm up cyberspace policy, and inject collectivism into cyber security plans of sectors as an improvement on the present stand alone security by banks in Nigeria.

The Cyberwarfare in Ukraine

The hybrid war in Ukraine is shaping cybersecurity for critical infrastructures and services worldwide. The events will be changing cybersecurity processes worldwide for a long time beyond the resolution of the conflict.

Cybersecurity Training in Norwegian Critical Infrastructure Companies

Human preparedness is a critical aspect of critical infrastructure (CI) cybersecurity. Many efforts, including educational curricula and training programs, have been taken at both national and company level to ensure human preparedness in CI incident response. These efforts are usually based on corporate requirements or external guidelines and policies. However, the best practices recommended for these efforts in the literature differ significantly from the measures implemented in CI companies. For this reason, we compared state of practice in cybersecurity awareness and training in selected CI companies with the recommendations in literature, aiming to identify the areas that CI companies need to increase efforts for further security implementations. Specifically, we conducted interviews (n=7) and sent out questionnaires to cybersecurity personnel (n=11) in different CI sectors of Norway. The collected data were analyzed to establish the commonalities, differences, and areas of concern among the interviewees, with respect to certain critical attributes. All Norwegian companies involved in the study offered some type of awareness or training activities to their employees, but these activities varied greatly in the level of maturity. Besides, we noted several limitations in methods and contents. According to many participants, the team skills, communication skills, and managerial skills were often inadequately developed. Additional limitations in delivery methods were noticed, too. Finally, we suggested the solutions from the best practices in the literature, and pointed out the areas where the literature has not provided effective measures.

Design of Platforms for Experimentation in Industrial Cybersecurity

The connectivity advances in industrial control systems have also increased the possibility of cyberattacks in industry. Thus, security becomes crucial in critical infrastructures, whose services are considered essential in fields such as manufacturing, energy or public health. Although theoretical and formal approaches are often proposed to advance in the field of industrial cybersecurity, more experimental efforts in realistic scenarios are needed to understand the impact of incidents, assess security technologies or provide training. In this paper, an approach for cybersecurity experimentation is proposed for several industrial areas. Aiming at a high degree of flexibility, the Critical Infrastructure Cybersecurity Laboratory (CICLab) is designed to integrate both real physical equipment with computing and networking infrastructure. It provides a platform for performing security experiments in control systems of diverse sectors such as industry, energy and building management. They allow researchers to perform security experimentation in realistic environments using a wide variety of technologies that are common in these control systems, as well as in the protection or security analysis of industrial networks. Furthermore, educational developments can be made to meet the growing demand of security-related professionals.

The concept of assessing the risks of cybersecurity of the information system of the critical infrastructure object

Ensuring cyber and information security for critical infrastructure is achieved through the implementation of an appropriate set of information security management measures, which can be provided in the form of software policies, methods, procedures, organizational structures and functions. Information security requirements are determined, in particular, by systematic risk assessment of information security, which can be one of the elements of the predicted approach to identifying hazards in the provision of services to service participants in the information interaction of the information system. The paper presents conceptual provisions for assessing and managing cybersecurity risks of the critical infrastructure information system. The proposed concept involves the definition of: areas of security threats to the information system; involved information assets and calculation of their value; assessment of the probability of attacks on the information system; assessment of the probability of success of attacks on the information system and more. Risk assessment methods are proposed that take into account the probability of success of an attack and the probability of an attack occurring, which makes it possible to eliminate the shortcomings inherent in known approaches and provide more accurate identification of attack methods associated with the attacker's behavior. The concept of cybersecurity risk assessment and the methodology for analyzing and assessing security threats that are presented in the work correspond to approaches to building risk-oriented information security management systems and can become the basis for developing an information security system in the information system of a critical infrastructure object.