Cybersecurity Incidents Research Articles

Determinants of Users’ Cybersecurity Behavior in the Metaverse: A Deep Learning-Based Hybrid SEM-ANN Approach

The Metaverse, an expansive online 3D virtual realm, has transformed how people work, socialize, and engage, but its growth brings critical cybersecurity challenges, particularly in data security and privacy. Since many cybersecurity incidents stem from human behavior, understanding factors influencing users’ cybersecurity practices in the Metaverse is vital. This study addresses the gap by proposing an integrated model based on Protection Motivation Theory (PMT), Health Belief Model (HBM), and Theory of Interpersonal Behavior (TIB), with trust as an additional construct. Using a hybrid structural equation modeling-artificial neural network (SEM-ANN) approach, data from 531 Metaverse users were analyzed. The results indicated that perceived vulnerability, self-efficacy, cues to action, habit, and trust significantly affect cybersecurity behavior, with “cues to action” identified as the most critical factor (97.8% normalized importance). Conversely, perceived severity, response efficacy, response costs, and facilitating conditions showed no significant impact. The findings offer theoretical insights and practical implications for Metaverse stakeholders and cybersecurity strategies.

System and Organization Controls (SOC) for Cybersecurity as a Nonaudit Service

SUMMARY As cybersecurity risk and disclosure requirements increase, companies are looking to audit practitioners to provide System and Organization Controls (SOC) for Cybersecurity assurance services. Companies can choose to use the same firm as their financial statement auditor (joint provisioning) or a separate assurance provider. This article summarizes a study examining the effects of joint or separate provisioning of this service and cybersecurity incidents on investors’ perceptions of audit quality and investment decisions (Perols and Murthy 2021). The study finds that when the service is jointly provisioned, the negative signal of a subsequent cybersecurity incident can reverse investors’ positive perceptions of auditor competence, increase investors’ sensitivity to potential independence impairments, and result in lower perceptions of audit quality. Overall, the study finds that investors can be less willing to invest in a company when the service is jointly compared to separately provisioned. This article highlights implications for companies, practitioners, and regulators.

Analysis for Network Security Measures for Protecting Organizational Data

Objectives: The number, severity, and sophistication of cybersecurity incidents are rising, suggesting that the next generation of cybersecurity threats cannot be fully mitigated by technical security controls alone. In order to strengthen cybersecurity in this day and age, end users must practise proper cyber hygiene. Methods: According to research, social culture affects reducing cybersecurity risk. The majority of research on the topic has been conducted in other nations, therefore it's possible that findings won't apply to India because of its distinct social and cultural norms. There is a dearth of research on the cybersecurity behaviour of Indian smartphone users by using descriptive analysis. Findings: In an effort to close the aforementioned research gap, our study has created a framework that enhances smartphone users' cybersecurity behaviour. This investigation was carried out in two stages by the researcher. Conclusion: Finding out about the present cybersecurity practices of Indian smartphone users was the first phase's goal. The second phase's goal was to create a framework and evaluate how well it works to improve smartphone users' cybersecurity behaviour.

Understanding Digital Forensic Tools: Their Features, Applicability and Key Short Comings. A Compendium

The Paper provides a comprehensive overview of various digital forensic investigation tools. The paper outlines the significance of digital forensics in collecting and preserving evidence for computer crimes and cybersecurity incidents. It discusses several prominent tools, including Encase Professional, Magnet Axiom, Passware Kit Forensic, Falcon Neo, Tableau USB Write Blocker, FTK Imager, and Autopsy, detailing their features, applications, and shortcomings. Key features highlighted include data acquisition methods, advanced file analysis capabilities, and reporting functionalities. The paper also addresses the potential limitations of these tools, such as issues with user authentication, performance under load, and chain of custody concerns. By examining these tools' strengths and weaknesses, the document aims to provide insights into their applicability in various investigative contexts and emphasize the importance of selecting appropriate tools for effective digital evidence management.

Finding grace in responses to adverse cybersecurity incidents

PurposeThe purpose of this study was to investigate the role of grace in the aftermaths of adverse cybersecurity incidents. Adverse incidents are an inescapable fact of life in organizational settings; consequences could be significant and costly. Increasingly, the cause may be a cybersecurity exploit, such as a well-targeted phishing email. In the aftermath, line managers have a choice in responding to the individual who caused the incident. Negative emotions, such as shame and regret, may deliberately be weaponized. Alternatively, positive emotions, such as grace, forgiveness and mercy, may come into play.Design/methodology/approachWe detail a study with 60 participants to explore attribution differences in response to adverse incidents, both non-cybersecurity and cybersecurity. We examined the stages that occur in the aftermath of such adverse incidents where grace may be observed.FindingsOur participants generally believed that grace was indicated toward those who triggered an adverse cybersecurity incident, pointing to situational causes. This was in stark contrast to their responses to the non-cybersecurity incident, where the individual was often blamed, with punishment being advocated.Research limitations/implicationsThe role of positive emotions merits investigation in the cybersecurity context if we are to understand how best to manage the aftermaths of adverse cybersecurity incidents.Practical implicationsOrganizations that mismanage aftermaths of adverse incidents by blaming, shaming and punishing those who make mistakes will harm the individual who made the mistake, other employees and the long-term health of their organization in the long run.Originality/valueTo the best of the authors’ knowledge, this is the first study to reveal the grace phenomenon in the cybersecurity context.

SolarWinds Attack: Stages, Implications, and Mitigation Strategies in the Cyber Age

SolarWinds is a software company based in the United States that provides IT monitoring and management tools. Founded in 1999, SolarWinds offers a variety of products that help organizations manage networks, systems, IT infrastructure, applications and cloud-based services. SolarWinds products are used for performance monitoring, log management, IT security, and data analysis. The company became widely known after a major cybersecurity incident came to light in late 2020, in which their network management software, Orion, was used as a vector for attacks by a state-backed hacking group. These attacks affected many organizations, including government agencies and private companies, and led to an increased focus on software supply chain security. This paper has reviewed stages, Implications, and mitigation strategies of SolarWinds.

Perception and Trust in Autonomous Vehicles Post Cyber Security Incidents

The integration of Autonomous Vehicles (AVs) into modern systems of transportation brings with it a new and transformative era. Central to the successful realisation of this transformation is the public’s trust in these vehicles and their safety, particularly in the aftermath of cyber security breaches. The following research therefore explores the various factors underpinning this trust in the context of cyber security incidents. A dual-methodological approach was used in the study. Quantitative data was gathered from structured questionnaires distributed to and completed by a cohort of 151 participants and qualitative data, from comprehensive semi-structured interviews with AV technology and cyber security experts. Rigorous Structural Equation Modelling of the quantitative data then allowed for the identification of the key factors influencing public trust from the standpoint of the research participants including the perceived safety of AV technology, the severity of cyber security incidents, the historic cyber security track record of companies and the frequency of successful cyber security breaches. The role of government regulations, though also influential, emerged as less so. The qualitative data, processed via thematic analysis, resonated with the findings from the quantitative data. This highlighted the importance of perceived safety, incident severity, regulatory frameworks and corporate legacy in shaping public trust. Whilst cyber incidents no doubt erode trust in AVs, a combination of technological perception, regulatory scaffolding and corporate history critically impacts this. These insights are instrumental for stakeholders, from policymakers to AV manufacturers, in charting the course of AV assimilation successfully in future.

Cybersecurity lessons from the Vastaamo psychotherapy data breach for psychiatrists and other mental healthcare providers.

The Vastaamo psychotherapy data breach in Finland is perhaps the largest cybersecurity incident in mental healthcare to date, resulting in significant patient harm. There are specific lessons for mental healthcare providers from an analysis of the incident. Case study of this specific electronic health record data breach, based on detailed media reporting. The issues raised include: the importance of governance of the cybersecurity of sensitive personal patient data, such as compliance with legislative requirements on privacy and data security; specific security measures such as de-identification of data, data protection via passwords, multi-factor authentication, firewalls and encryption; and timely and effective communication, and support of those who have been affected. The implications for mental healthcare providers, including psychiatrists and trainees, are that, within their capability, providers need to assess the efficacy and robustness of cybersecurity of electronic health record systems they use, and carefully consider the information that is recorded to minimise exposures such as in the Vastaamo breach.

A Comprehensive Analysis of Maritime Cyber Security Incidents: Trends, Impacts, and Countermeasures

The maritime industry is currently experiencing a process of digital transformation, which involves a significant level of automation and enhanced communication with external networks. As a result, various facilities in the maritime sector such as commercial and navy vessels, shipping companies, ports, and shipbuilders, are becoming more susceptible to cyber threats. In addition to the potential economic and reputational harm to shipping companies, a cyber-attack on maritime systems could result in significant incidents such as the release of hazardous substances, collisions, grounding, and fires. This poses significant risks to both ship crew, ship, cargo, and environment. This study examines cyber security events in the maritime sector. The main objective is to cultivate a thorough comprehension of cyber-attacks that specifically target systems in maritime facilities, by analyzing insights derived from incidents in the Maritime Cyber-Attack Database. The work involves the construction and examination of a number of cyber security incidents. An inquiry is carried out to determine the time patterns, geographical spread, sector-specific consequences, and attributes of these cyber-attacks, including the identity of the perpetrator, intention (whether deliberate or unintentional), and the affected systems inside the maritime domain. The paper examines particular instances to identify the main stages of a cyber-attack on maritime facilities' systems, the fundamental strategies employed by attackers, and proposes standard cyber security solutions to reduce these risks. The study's contribution entails the methodical delineation of the cyber security terrain that is unique to the maritime industry.

A digital forensic analysis of an electrocardiogram medical device: A first look

AbstractThe increased frequency and severity of cybersecurity incidents impacting healthcare organizations has prompted the publication of suggested best practices for these organizations, when attempting to respond to incidents in their respective settings. While these best practices provide a wealth of information on how to respond to a cybersecurity incident impacting medical devices, minimal information is provided related to the forensics investigation of the devices themselves. A growing appetite for digital evidence from medical devices, coupled with limited practical guidance from industry best practices prompts an investigation into identifying tools and techniques to assist digital forensic investigators with device disassembly, data acquisition, and preservation of evidence in medical devices. This paper presents the results of a detailed exploratory case study involving the digital forensic investigation of a General Electric MAC 800 electrocardiogram medical device. The contributions of this research are threefold. First, it provides an empirical demonstration of practical techniques for acquiring and examining residual data from the electrocardiogram medical device. Second, the research documents the artifacts that can be recovered from the medical device, which could be used as potential evidence. Third, it provides the foundation for future investigations regarding the tools and processes suitable for examining additional medical devices.This article is categorized under: Digital and Multimedia Science > Cybercrime Investigation Digital and Multimedia Science > IoT Forensics

Legal implications for clinicians in cybersecurity incidents: A review.

Cybersecurity incidents in healthcare present significant legal implications for clinicians, necessitating careful consideration of technological advancements and regulatory frameworks. This literature examines the healthcare cybersecurity landscape, emphasizing clinicians' challenges, and legal responsibilities. It explores the impact of advanced technologies such as artificial intelligence and quantum computing, highlighting the potential benefits and risks, including biases and ethical dilemmas. The review addresses international regulatory differences, offering a comparative analysis of how various countries handle cybersecurity incidents. This analysis provides insights into best practices and identifies areas for improvement. Practical recommendations are provided, tailored to different healthcare settings, including large hospitals and small clinics, to enhance cybersecurity preparedness. Case studies illustrate real-world scenarios, offering practical guidance for clinicians in managing cybersecurity challenges. The review also identifies critical gaps in the literature, particularly concerning artificial intelligence ethics and international regulatory frameworks, suggesting specific areas for future research. These findings underscore the need for robust cybersecurity policies, comprehensive training for healthcare professionals, and a nuanced understanding of the legal landscape. This review informs policymakers, clinicians, and researchers about the evolving nature of cybersecurity challenges in healthcare, addressing key concerns raised by reviewers and contributing to a comprehensive understanding of the field.

Implications of cyber incident reporting obligations on multinational organizations headquartered in Switzerland

As the digital landscape evolves, states are increasingly implementing national cyber incident reporting obligations to enhance cyber resilience. This study investigates the implications of these obligations on multinational organizations, focusing on the variability of compliance requirements across jurisdictions and the challenges faced by companies in adhering to these diverse regulations. Through the methodological approach of conducting interviews with cybersecurity experts across various sectors, this study points out the growing complexity in cybersecurity incident reporting obligations. Findings reveal that companies employ multiple strategies to report to regulators, monitor regulatory changes, and educate employees responsible for reporting. However, maintaining compliance is identified as a significant challenge across all sectors, leading to calls for the standardization of regulations and the improvement of automation solutions. Given the lack of research in this area, this work lays the groundwork for future research, opening new avenues for investigation into the potential standardization and automation of cyber incident reporting processes.

May the Source Be with You: On ChatGPT, Cybersecurity, and Secure Coding

Software security is an important topic that is gaining more and more attention due to the rising number of publicly known cybersecurity incidents. Previous research has shown that one way to address software security is by means of a serious game, the CyberSecurity Challenges, which are designed to raise awareness of software developers of secure coding guidelines. This game, proven to be very successful in the industry, makes use of an artificial intelligence technique (laddering technique) to implement a chatbot for human–machine interaction. Recent advances in machine learning have led to a breakthrough, with the implementation and release of large language models, now freely available to the public. Such models are trained on a large amount of data and are capable of analyzing and interpreting not only natural language but also source code in different programming languages. With the advent of ChatGPT, and previous state-of-the-art research in secure software development, a natural question arises: to what extent can ChatGPT aid software developers in writing secure software? In this work, we draw on our experience in the industry, and also on extensive previous work to analyze and reflect on how to use ChatGPT to aid secure software development. Towards this, we conduct two experiments with large language models. Our engagements with ChatGPT and our experience in the field allow us to draw conclusions on the advantages, disadvantages, and limitations of the usage of this new technology.

Navigating cybersecurity challenges: Legal implications and organizational strategies

The increasing frequency and sophistication of cybersecurity incidents—such as data breaches, ransomware attacks, and system violations—highlight significant legal and organizational challenges. Despite rising investments in cybersecurity, these incidents continue to evolve, presenting complex issues for both corporations and regulators. Traditional legal frameworks, primarily focused on financial damages, fail to address non-financial harms like emotional and psychological impacts on consumers. Studies by Teichmann and Wittmann (2022) and Kilovaty (2021) reveal gaps in current cybersecurity laws, emphasizing the need to incorporate psychological damages and enhance corporate liability standards. Research by Frank, Grenier, and Pyzoha (2021) demonstrates the increasing litigation risks for boards of directors following cybersecurity incidents. Their findings suggest that prior cyberattacks raise the likelihood of being held liable, though implementing frameworks like the American Institute of Certified Public Accountants’ (AICPA) risk management guidelines can mitigate these risks. Additionally, Eijkelenboom and Nieuwesteeg (2020) analyze the disclosure of cybersecurity information in Dutch annual reports, finding a lack of transparency despite legal requirements. Their study underscores the need for better self-regulation or potential legal mandates to improve cybersecurity reporting. Falowo et al. (2022) examine the impact of digital interconnectedness on cybersecurity risks, noting that malware and phishing attacks are prevalent. Their research highlights the importance of organizational preparedness and adherence to frameworks such as the National Institute of Standards and Technology (NIST) guidelines for effective incident response. Sen (2018) identifies ongoing technical, economic, legal, and behavioral challenges that hinder effective cybersecurity, advocating for new strategies to overcome these barriers. Overall, enhancing cybersecurity resilience requires a comprehensive approach, integrating improved legal frameworks, organizational transparency, and proactive risk management.

Employee Awareness and Attitudes Towards Cybersecurity Technologies

This study explores employee awareness and attitudes towards cybersecurity technologies. As organizations strive to improve their cybersecurity measures, the human element remains a critical yet often overlooked factor. This research investigates the correlation between employee awareness and the adoption of emerging cybersecurity technologies, the impact of these technologies on cybersecurity incident rates, and the relationship between employee satisfaction and cybersecurity awareness. A qualitative exploration approach was employed, utilizing data from peer-reviewed publications, technology conference proceedings, and industry reports. Surveys of cybersecurity experts and organizational executives were conducted to identify recurring themes and concerns. The findings reveal that increased employee awareness significantly enhances the effectiveness of cybersecurity measures and reduces security incidents. Furthermore, the study highlights the necessity of continuous training and education for employees to maintain a robust cybersecurity posture. The research also emphasizes the importance of integrating cybersecurity technologies into daily operations to enhance their efficacy. This comprehensive examination aims to assist organizations in developing resilient cybersecurity strategies that address both technological and human factors.

Incident Response and Threat Intelligence in Healthcare: A Study on Cybersecurity Incident Management

India and other Asian nations are seeing an unparalleled pace of advancement in the modernisation of their healthcare systems. In this endeavour, information technology is crucial. Though the healthcare industry has made great progress, information security is still lagging behind the protection requirements attained in technologically developed nations such as the United States and the United Kingdom. This study is an honest attempt to pinpoint vulnerabilities and dangers in the field of cybersecurity and offers a few targeted remedies in three main domains: risks, vulnerabilities, and IoMT. Using a qualitative research methodology, this research culminates in the creation of a security maturity model for Indian healthcare. Furthermore, in light of these attacks, the well-known National Institute of Standards and Technology (NIST) risk assessment system and its guiding principles are examined. Evaluating the risks intrinsic to these hacks analytically becomes crucial given the comparatively low information risk management maturity levels in Asian healthcare organisations. While several nations in Asia and throughout the world are battling the COVID-19 outbreak, cybercriminals have been attempting to spread misinformation about vaccines. Additionally, some people and organisations are attempting to undermine specific vaccines in order to promote their COVID-19 treatments. Hacking research data, virus testing, and clinical studies that reveal side effects or possible issues are of particular interest to profit-seeking businesses. The secure methodology for identifying network attacks is suggested by this study.

Understanding the Root Cause of Cybersecurity Incidents Through DuPont’s Dirty Dozen Framework

Cybersecurity incidents, such as data breaches, pose a significant threat to organisations. Shockingly, 95% of these incidents occur due to human errors. Despite organisations making substantial efforts to reduce the likelihood of such occurrences through technological and non-technological means, the frequency of these incidents has been increasing. Previously, organisations relied on technology as the primary barrier to minimise cybersecurity incidents and achieve their objectives. Although research indicates that humans are the weakest link in an organisation's efforts to combat cybersecurity incidents, organisations still consider technology as the key to improving security defences. Therefore, the researchers suggest improving human interventions should precede technological means to overcome the problem. They propose that existing information security plans should consider human factors in cybersecurity risk management. Prioritising an understanding of human factors in managing information security can help organisations identify the relationships between various dimensions of human errors and cybersecurity incidents. To achieve this, the paper suggests solving the human factor problem in cybersecurity incidents by explaining how DuPont's Dirty Dozen framework, commonly used in aviation, can help understand why cybersecurity incidents and accidents occur. The framework lists twelve human behaviours that can be used to understand the relationships between various dimensions of human errors and cybersecurity incidents. By understanding these relationships, organisations can improve their cybersecurity strategies by anticipating, mitigating, and resolving issues more effectively and efficiently.

SpecRep: Adversary Emulation Based on Attack Objective Specification in Heterogeneous Infrastructures.

Cybercriminals have become an imperative threat because they target the most valuable resource on earth, data. Organizations prepare against cyber attacks by creating Cyber Security Incident Response Teams (CSIRTs) that use various technologies to monitor and detect threats and to help perform forensics on machines and networks. Testing the limits of defense technologies and the skill of a CSIRT can be performed through adversary emulation performed by so-called "red teams". The red team's work is primarily manual and requires high skill. We propose SpecRep, a system to ease the testing of the detection capabilities of defenses in complex, heterogeneous infrastructures. SpecRep uses previously known attack specifications to construct attack scenarios based on attacker objectives instead of the traditional attack graphs or a list of actions. We create a metalanguage to describe objectives to be achieved in an attack together with a compiler that can build multiple attack scenarios that achieve the objectives. We use text processing tools aided by large language models to extract information from freely available white papers and convert them to plausible attack specifications that can then be emulated by SpecRep. We show how our system can emulate attacks against a smart home, a large enterprise, and an industrial control system.

Hey “CSIRI”, should I report this? Investigating the factors that influence employees to report cyber security incidents in the workplace

Purpose Cyber security incidents pose a major threat to organisations. Reporting cyber security incidents and providing organisations with information about their true nature, type and volume, is crucial to inform risk-based decisions. Despite the importance of reporting cyber security incidents, little research has addressed employees’ motivations to do so. Therefore, the purpose of this study is to investigate the factors that influence employees to report cyber security incidents using the theory of planned behaviour as a theoretical framework. Design/methodology/approach Survey data were collected from a sample of 549 working Australian adults. Demographics were gathered, in addition to data using the Cyber Security Incident Reporting Inventory (CSIRI; pronounced, “Siri”). Findings Attitude towards reporting, subjective norms and perceived behavioural control each significantly predicted intention-to-report cyber security incidents. Perceived behavioural control also significantly predicted actual reporting behaviour. Research limitations/implications The results of this study validate the application of the theory of planned behaviour to the cyber security incident reporting context, also indicating that the relationship between intention to report a cyber security incident and actual reporting behaviour may be facilitated by perceived behavioural control. Practical implications These findings can be applied to inform the development of strategies that increase employees’ cyber security incident reporting behaviour. Originality/value This study outlines the development of a new tool to measure attitudes, subjective norms and perceived behavioural control in relation to the reporting of cyber security incidents. To the best of the authors’ knowledge, this is the first study of its kind to identify the relationship between these factors and intentions to report cyber security incidents.

Penetration Study of Key Technologies for Cybersecurity Risk Assessment

In recent years, with the frequent occurrence of cyber security incidents, people have paid more attention to it. Information security risk assessment is a very important research topic. This paper gives a brief overview of the theory of cybersecurity risk assessment, focuses on the description of the current mainstream cybersecurity risk assessment methods, classifies and compares the existing methods according to the nature of the methods, and analyses the advantages, disadvantages, and application scope of each method. Finally, the main factors affecting the evaluation results are summarized and refined, and future research hotspots in this field are proposed. Through the empirical analysis of the three factors, the influence of the correlation of the three factors, the uncertainty of the evaluation indexes, and the timeliness of the evaluation on the evaluation results are concluded, which provides a reference for future research on evaluation methods.