Cybersecurity Knowledge Research Articles

A Cyber-Diplomacy and Cybersecurity Awareness Framework (CDAF) for Developing Countries

Cybersecurity is high on the agenda of national and international security policy discussions – mostly lead by diplomats. The practise of diplomacy has evolved since the Internet has become the backbone of society as we know it. Technological evolution has resulted in a significantly bigger and more accessible cyberspace, but the ability of governments and institutions to respond to and function in an expanding cyberspace seems to be lagging behind. The practice of diplomacy has similarly changed fundamentally and created a cyber-diplomacy environment where there is an increased utilization of inter alia social media platforms to achieve foreign policy goals. There is not enough attention given to practical processes to guide the new breed of diplomats in the evolving world of cyber-diplomacy and there is a need to improve the cybersecurity awareness of diplomats in all countries, but this article will focus primarily on developing countries. To mitigate potential cyber threats to diplomacy, diplomats need to be subjected to cyber-diplomacy orientation as well as functional cyber awareness training. Preliminary research conducted suggests that there is a gap between the existing and required cyber-diplomacy and cybersecurity awareness levels of diplomats from developing countries. The purpose of the article is to present a cyber-diplomacy and cybersecurity awareness framework (CDAF) that can be used by developing countries to equip their diplomats to play a more constructive role within the international cyber-diplomacy domain. The CDAF comprises of two distinct components, namely cyber-diplomacy and cybersecurity awareness, but this article will focus primarily on the cyber-diplomacy capacity building aspect of the CDAF. The CDAF was developed by following a design science research approach where a real-world problem was identified followed by an in-depth literature review to identify objectives and possible solutions to the problem. The subsequent outcomes were used to design and development of the CDAF. The article concludes with a critical evaluation of the proposed framework as well as how it can be incorporated into the developing cybersecurity knowledge modules of the Global Forum on Cyber Expertise (GFCE).

Assessing the Level of Cybersecurity Knowledge of Computer Science and Applied Automation Undergraduates

The importance and role of cybersecurity awareness is more pressing than ever in today’s modern world and therefore, this concern gave voice to a number of studies evaluating the level of preparedness of individuals and professionals regarding cybersecurity aspects. Furthermore, the number of open positions on the job market in the field of cybersecurity highlight the topicality of the subject. In this paper, the author analyzed the level of knowledge that last year Computer Science and Applied Automation undergraduate students possess and also examined current practices around the world regarding cybersecurity education with the role of understanding the implications of cybersecurity education and proposing a set of measures and activities that can be applied to facilitate the educational process in the field of cybersecurity.

Autonomous Vehicles: Improving Cyber Security

The purpose of this paper is to address the knowledge and implementation gap in Cyber Security within the field of autonomous vehicles. As technology progresses, the utilization of autonomous vehicles will become more mainstream. With such potential for a broader use of such technology, it is crucial that security is ensured. Previous research has indicated that there are levels to vehicle autonomy which range from zero to five. Zero indicates a vehicle with no automation, while five indicates a fully automated vehicle. The potential areas which can be targeted by cyber attackers include the network which the vehicles operate within, the sensors which the vehicle uses to detect where it is going and what actions are needed to provide a safe journey, and the vehicle GPS system. The research aims to find out where the greatest weakness is within autonomous vehicles, and what software and hardware is targeted by cyber attackers, as to provide comprehensive and long lasting solutions within the field of autonomous vehicle security. As for unit of analysis, a focus will be placed on both consumers and organizations, with greater emphasis on the organizations which produce autonomous vehicles. A qualitative approach will be utilized as to streamline the process of understanding the problem through previously done research. At the current time this research aims to provide hypothetical solutions due to lack of field testing potential at this moment, however it is hoped that research and development of greater security protocols will continue to be done to evolve and provide greater security in autonomous vehicles.

Toward Human Digital Twins for Cybersecurity Simulations on the Metaverse: Ontological and Network Science Approach

Background Cyber defense is reactive and slow. On average, the time-to-remedy is hundreds of times larger than the time-to-compromise. In response, Human Digital Twins (HDTs) offer the capability of running massive simulations across multiple domains on the Metaverse. Simulated results may predict adversaries' behaviors and tactics, leading to more proactive cyber defense strategies. However, current HDTs’ cognitive architectures are underdeveloped for such use. Objective This paper aims to make a case for extending the current digital cognitive architectures as the first step toward more robust HDTs that are suitable for realistic Metaverse cybersecurity simulations. Methods This study formally documented 108 psychology constructs and thousands of related paths based on 20 time-tested psychology theories, all of which were packaged as Cybonto—a novel ontology. Then, this study applied 20 network science centrality algorithms in ranking the Cybonto psychology constructs by their influences. Results Out of 108 psychology constructs, the top 10 are Behavior, Arousal, Goals, Perception, Self-efficacy, Circumstances, Evaluating, Behavior-Controllability, Knowledge, and Intentional Modality. In this list, only Behaviors, Goals, Perception, Evaluating, and Knowledge are parts of existing digital cognitive architectures. Notably, some of the constructs are not explicitly implemented. Early usability tests demonstrate that Cybonto can also be useful for immediate uses such as manual analysis of hackers’ behaviors and automatic analysis of behavioral cybersecurity knowledge texts. Conclusions The results call for specific extensions of current digital cognitive architectures such as explicitly implementing more refined structures of Long-term Memory and Perception, placing a stronger focus on noncognitive yet influential constructs such as Arousal, and creating new capabilities for simulating, reasoning about, and selecting circumstances.

The impact of financial deprivation on children’s cybersecurity knowledge & abilities

Online users require a working knowledge of password “best practice”, as well as the ability to apply such knowledge. Children increasingly operate as independent agents online, and thus also need to be aware of password “best practice”. To meet this need, the Scottish curriculum for excellence includes lessons about password “best practice”. Hence, all Scottish children ought, theoretically, to have similar levels of password-related knowledge. They ought also, by age 8-9, to be able to apply their knowledge. One factor that could deter password-related knowledge acquisition and skill development is financial deprivation. To gauge its impact, we assessed the knowledge and abilities of Scottish 8-9 year old children, in four primary schools, in areas of varying financial deprivation. We uncovered stark differences in knowledge and password retention. There is a clear need for an extra-curricular intervention programme to teach up-to-date password “best practice” and support in developing the required password management skills. This will reduce their online vulnerabilities, whatever their socio-economic background.

Analysis of Cyber Security Knowledge and Skills for Capture the Flag Competition

CTF (Capture The Flag) competitions have emerged as a pivotal instrument in development of cyber security education over the past six years. It is imperative to ensure that the CTF competitions continue to develop to facilitate growth of cyber security education. To achieve the desired growth, it is necessary to analyze the progress achieved in the last six years the program has been implemented. This research collects and analyzes approximately 500 CTF solutions from the CTFtime platform. From the results of this analysis, we have identified that skills and techniques are needed in each category of CTF questions. We use the results of this analysis as a reference for questions on the CTF Platform that we created during PCT (Polibatam Cyber ​​Team) regeneration. PCT consists of a group of students from the Cyber ​​Security Engineering study program who are prepared to be at the forefront in participating in various activities related to Cyber ​​Security. The method we use is different from other CTFs, in that we use a skill-based and technique-based approach. We found that this approach was able to attract 80% of participants in solving and improving their skills in Cyber Security towards any challenges in a competitive environment.

A Comprehensive Review on the Cyber Security Methods in Indian Organisation

Abstract Cyber security, an application that protects and controls the systems, programs, networks, data and devices from cyber-attacks. This cyber security practice used by individuals and small or large organizations for protecting against unusual data access. A powerful cyber security system provides a great security against malware attacks, viruses, ransom ware, cloud attacks, IoT attacks etc. and it designed for accessing, destroying, deleting and altering these attacks and secure the retrieving data from the server and user’s systems. This paper discuss about the importance of cyber security in organizations of India. Surveys of Indian organization’s cyber security measures are taken for the evaluation of the methods and challenges of cyber security. This comprehensive review provides insights about securing the data by employing cyber security frame works, risk assessment models and educating cyber security knowledge among public with help of government public programs. With these information this paper helps for overcoming the cyber threats and attacks and created a pre cautionary thought and also made a pre vision for diminishing theft of data among employees and tracking hacker’s activities before attacking the organizations. Keywords: cyber security, Indian organization, cyber-attacks, cyber security methods, DDoS attack.

Adopting the cybersecurity concepts into curriculum: the potential effects on students’ cybersecurity knowledge

<span>This study examines the effect of adopting cybersecurity concepts on the information and technology (IT) curriculum and determines the potential effect on students' knowledge of cybersecurity practices and level of awareness. To this end, a pilot study was first conducted to measure the current level of cybersecurity awareness. The results revealed that students do not have much knowledge of cybersecurity. Thus, a four-step approach was proposed to infuse the relevant cybersecurity topics in five matched courses based on the latest cybersecurity curricular guidelines (CSEC2017). A sample of 42 students was selected purposively without prior knowledge of cybersecurity and divided identically into experimental and control groups. Students in the experimental group were asked to take five consecutive courses over five semesters. In each course, groups went through a pre-test for the infused topics. Then, the experimental group taught the corresponding infused topics. A post-test was administered to both groups at the end of each course, and the t-test was conducted. The results found significant differences between marks of prior and post-tests for 11 out of 14 infused topics. These satisfactory results would encourage universities to infuse cybersecurity concepts into their curriculum.</span>

An assessment of cybersecurity awareness level among Northeastern University students in Nigeria

<p>The world economy today has adopted the internet as a medium of transactions, this has made many organizations use the internet for their daily activities. With this, there is an urgent need to have knowledge in cybersecurity and also how to defend critical assets. The objective of this paper is to identify the level of cybersecurity awareness of students in Northeastern Nigeria. A quantitative approach was used for data collection and cyberbully, personal information, internet banking, internet addiction, and Self-protection were the items ask for cybersecurity awareness level identification. Descriptive analysis was performed for initial result findings using SPSS and OriginPro for graphical design. the preliminary result shows of the students have some basic knowledge of cybersecurity in an item like internet banking, while other items like cyberbully, self-protection and, internet addiction result show moderate awareness, the students' participation based on gender, males constitute 77.1% i.e. (N=340) and females constitute 22.9% i.e. (N=101). Future research would concentrate on designing awareness programs that would increase the level of their awareness especially the students in the Northeastern part of Nigeria.</p>

Developing and evaluating cybersecurity competencies for students in computing programs.

Changes due to technological development in the workplace are putting pressure on academia to keep pace with the changing nature of work. Due to the growing need for cybersecurity professionals, universities improve their cybersecurity programs to develop qualified cybersecurity competencies. The purpose of this study is to validate the cybersecurity knowledge, skills, and abilities (KSAs) competencies of cybersecurity degree programs using a fuzzy linguistic group decision-making method. This study shows that cybersecurity knowledge is essential, along with technical skills and human abilities for cybersecurity professionals.

Cybersecurity Enterprises Policies: A Comparative Study.

Cybersecurity is a critical issue that must be prioritized not just by enterprises of all kinds, but also by national security. To safeguard an organization’s cyberenvironments, information, and communication technologies, many enterprises are investing substantially in cybersecurity these days. One part of the cyberdefense mechanism is building an enterprises’ security policies library, for consistent implementation of security controls. Significant and common cybersecurity policies of various enterprises are compared and explored in this study to provide robust and comprehensive cybersecurity knowledge that can be used in various enterprises. Several significant common security policies were identified and discussed in this comprehensive study. This study identified 10 common cybersecurity policy aspects in five enterprises: healthcare, finance, education, aviation, and e-commerce. We aimed to build a strong infrastructure in each business, and investigate the security laws and policies that apply to all businesses in each sector. Furthermore, the findings of this study reveal that the importance of cybersecurity requirements differ across multiple organizations. The choice and applicability of cybersecurity policies are determined by the type of information under control and the security requirements of organizations in relation to these policies.

Revisiting Cybersecurity Awareness in the Midst of Disruptions

The awareness of cybersecurity and knowledge about risks from a variety of threats, which present harm or steal private information in internetworking could help in mitigation of vulnerabilities to risks of threats in safeguarding information from malware and bots. Revisiting cybersecurity awareness of every member and evaluation of organization’s posture might help to protect sensitive or private information from a network of computers, working together and forming into botnets. The purpose of the qualitative case study narrative was to explore prospects for integrating cybersecurity education into elementary school children’s curriculum through interviews of elementary schoolteachers, IT experts, and parents to gain feedback about perceptions on cybersecurity knowledge and awareness. The analysis of schools’ organizational security postures related to all levels of education, recommending in raising awareness of the underlying and unprecedented security vulnerabilities. One area of greatest need is in protecting the wellbeing of people in securing private or protected assets and sensitive information, most valuable and vulnerable amid disruption. The possible lack of cybersecurity awareness in online settings could increase an organizational vulnerability to risks of threats and outsider attempts to install malware during a variety of cyber-attacks. Organizations with online ambiguity face a threat from botnets to infect networks. This qualitative exploratory single case-study into perceptions of teachers and leaders, information technology (IT) experts, and parents of elementary school children about cybersecurity awareness level of children in elementary schools helped to reinforce the important role of education in building foundational cyber-safety practices.

CSKG4APT: A Cybersecurity Knowledge Graph for Advanced Persistent Threat Organization Attribution

Open-source cyber threat intelligence (OSCTI) is becoming more influential in obtaining current network security information. Most studies on cyber threat intelligence (CTI) focus on automating the extraction of threat entities from public sources that describe attack events. The cybersecurity knowledge graph aims to change the expression of threat knowledge so that security researchers can accurately and efficiently obtain various types of threat information for preliminary intelligent decisions. The attribution technology can not only assist security analysts in detecting advanced persistent threats, but can also identify the same threat from different attack events. Therefore, it is important to trace the attack threat actor. In this study, we used the knowledge graph technology, considered the latest research on cyber threat attack attribution, and thoroughly examined key related technologies and theories in the process of constructing and applying the advanced persistent threat (APT) knowledge graph from OSCTI. We designed a cybersecurity platform named CSKG4APT based on a knowledge graph. Inspired by the theory of ontology, we constructed CSKG4APT as an APT knowledge graph model based on real APT attack scenarios. We then designed an APT threat knowledge extraction algorithm for completing and updating the knowledge graph using deep learning and expert knowledge. Finally, we proposed a practical APT attack attribution method with attribution and countermeasures. CSKG4APT is not a passive defense method in traditional network confrontation but one that integrates a large amount of fragmented intelligence and can actively adjust its defense strategy. It lays the foundation for further dominance in network attack and defense.

Effects of Cybersecurity Knowledge and Situation Awareness During Cyberattacks on Autonomous Vehicles

Effects of Cybersecurity Knowledge and Situation Awareness During Cyberattacks on Autonomous Vehicles

Cyber-Security Culture towards Digital Marketing Communications among Small and Medium-Sized (SME) Entrepreneurs

Cybersecurity is a multidisciplinary field of study that focuses on preserving and protecting data and information from a wide range of threats and dangers. This study presents a cyber-security culture for assessing the knowledge, attitude and practice towards digital marketing communications among small and medium-sized entrepreneurs. The objectives of this study were to identify the knowledge, attitudes, and practices of cyber-security culture toward digital marketing communications among small and medium-sized entrepreneurs in Selangor, as well as to look into the relationship between knowledge and practice in this area. This study utilized a quantitative methodology in the form of a survey, with respondents being selected at random from a list of numbers and from a box of random numbers. Several lists were generated using Instagram business account listings, telegram entrepreneur groups, the National Entrepreneurs Institute, and the Kuala Selangor District Council webpage for recruiting respondents. From the findings, this study found that there is a strong relationship between the level of knowledge and practices towards cybersecurity in digital marketing communications among small and medium-sized entrepreneurs. The study concluded that good knowledge of cybersecurity is crucial among entrepreneurs for them to establish good practices in managing their business.

An Interdisciplinary Study of Cybersecurity Investment in the Nonprofit Sector

Cybersecurity is becoming a worldwide priority. It is critical for organizations to quantify losses from cybercrimes and make informed decisions on cybersecurity investments. This paper expands the body of knowledge in cybersecurity of nonprofit organizations (NPOs)—a less-researched area—by examining investment in NPOs’ cybersecurity from the business and economics perspectives. The authors combine two economics and risk management models to quantify the potential loss caused by a cyberattack. The paper provides a hypothetical example of applying the insights from the GL and FAIR risk models to assess the information assets of an NPO and calculating the optimal level of cybersecurity investment. Developing cybersecurity measures for NPOs is equally important as developing cybersecurity strategies, tools, and policies for large corporations or small businesses. Therefore, the findings of this paper can serve as decision-making tools for NPOs to evaluate information security assets, estimate the potential loss caused by cyberattacks, and determine the optimal investment value in cybersecurity measures.

Cybersecurity knowledge and skills for port facility security officers of international seaports: Perspectives of IT and security personnel

Cyberattacks on worldwide port facilities have highlighted the urgent need for port facility security officers (PFSOs) to upgrade their cybersecurity knowledge and skills. This study used the survey data from all international container ports in Thailand and analyzed the results from two perspectives, i.e., IT and security officers. Based on 73 responses, cybersecurity knowledge and skill would become essential for PFSOs than ever before because the port digitalization and automation would shape the PFSOs career to a technically-oriented specialist rather than a multi-skilled generalist. Furthermore, the responsibilities of PFSOs would extend to cover cyber risk management, which enables them to prevent the digital port facilities from emerging cyber threats. Therefore, they should learn how to incorporate the existing risk management process with cyber risk management and cybersecurity knowledge because these would be the foundation for PFSOs to practice cybersecurity skills. At the end of the learning process, PFSOs could also gain cybersecurity competence once they have mature knowledge and skill, which would be the vital element of port security hygiene.

Psychometric Evaluation of the Cybersecurity Concept Inventory

We present a psychometric evaluation of a revised version of the Cybersecurity Concept Inventory (CCI) , completed by 354 students from 29 colleges and universities. The CCI is a conceptual test of understanding created to enable research on instruction quality in cybersecurity education. This work extends previous expert review and small-scale pilot testing of the CCI. Results show that the CCI aligns with a curriculum many instructors expect from an introductory cybersecurity course, and that it is a valid and reliable tool for assessing what conceptual cybersecurity knowledge students learned.

Cybersecurity Awareness Framework for Academia

Cybersecurity is a multifaceted global phenomenon representing complex socio-technical challenges for governments and private sectors. With technology constantly evolving, the types and numbers of cyberattacks affect different users in different ways. The majority of recorded cyberattacks can be traced to human errors. Despite being both knowledge- and environment-dependent, studies show that increasing users’ cybersecurity awareness is found to be one of the most effective protective approaches. However, the intangible nature, socio-technical dependencies, constant technological evolutions, and ambiguous impact make it challenging to offer comprehensive strategies for better communicating and combatting cyberattacks. Research in the industrial sector focused on creating institutional proprietary risk-aware cultures. In contrast, in academia, where cybersecurity awareness should be at the core of an academic institution’s mission to ensure all graduates are equipped with the skills to combat cyberattacks, most of the research focused on understanding students’ attitudes and behaviors after infusing cybersecurity awareness topics into some courses in a program. This work proposes a conceptual Cybersecurity Awareness Framework to guide the implementation of systems to improve the cybersecurity awareness of graduates in any academic institution. This framework comprises constituents designed to continuously improve the development, integration, delivery, and assessment of cybersecurity knowledge into the curriculum of a university across different disciplines and majors; this framework would thus lead to a better awareness among all university graduates, the future workforce. This framework may be adjusted to serve as a blueprint that, once adjusted by academic institutions to accommodate their missions, guides institutions in developing or amending their policies and procedures for the design and assessment of cybersecurity awareness.

Changing the landscape of cybersecurity education in the EU: Will the new approach produce the required cybersecurity skills?

Recruiting, retaining, and maintaining sufficient numbers of cybersecurity professionals in the workplace is a constant battle, not only for the technical side of cybersecurity, but also for the overlooked area of non-technical, managerial-related jobs in the cyber sector. The problem is the lack of cybersecurity skills in the European labour force. This paper presents the results of a study carried out with the aim to identify how much the cybersecurity education system within the high-level educational institutions and the industrial sector meets the needs for graduate students to gain the required cybersecurity skills. The method applied in the study is based on data collected from surveys carried out by the European competence centres on cybersecurity and the European Cybersecurity organisation. The problem of common educational program accreditation in Europe is highlighted and discussed. The actions undertaken to improve the education in both sectors are described and the emerging educational landscape is commented. The main cybersecurity knowledge specified by the industrial needs is presented in the form of five knowledge pillars. The study’s findings show that there are missing topics in high-level institution’s cybersecurity programs and that that there is a need to re-shape the content of the courses provided by the professional education providers.