Cybersecurity Policy Research Articles

Cybersecurity Policy of Modern Education

The subject of the study is the activity of law enforcement agencies in the fight against cybercrime. The object of the study is the social relations that arise in the field of education during the implementation of the program to combat cybercrime in Russia. The author examines the issues of crimes committed with the help of information technologies or in cyberspace, as well as the organization of counteraction to their commission, activities aimed at protecting the health of citizens, ensuring state and public security. Studies the process of using modern methods in the identification and disclosure of crimes committed using information and telecommunication technologies. Special attention is paid to the strategy of digital transformation of education of schoolchildren and students: according to which students will be able to master the knowledge necessary to protect themselves and their data when working with technical means of communication. The novelty lies in the fact that the way being worked out to solve the problem of growing crime in the information environment and crime using modern technologies directly affects the modern educational processes of schoolchildren and students, who in the future should become a bulwark of protecting the population from cybercrime. The main conclusion of the study is that such an improvement in education will increase the general digital literacy of the population, the level of public confidence in the state, and in particular in law enforcement agencies. It will provide a fast, comprehensive search for malicious sites, in view of which their number, as well as the negative effect of such, will decrease, which will lead to a decrease in cybercrime in Russia.

A COMPARATIVE ANALYSIS OF THE IMPACT OF SOCIAL NETWORKING SITES AND THE RELATING STATUTES

The Internet is a massive computer complex that has caused millions of deaths and served both as a force of protection and destruction. As all coins have two faces, another hand of Internet is that it had overwhelmed the population by making them authentic to such a base, and multitudinous fake malefactors were in control of the situation on a single face where everything from shopping to cooking to watching live sports events was made easier. In addition, a social networking community is a community which connects or adjoins one people or community with another people or community around the globe whose health and backgrounds are insolvable to distinguish. A healthy app like Facebook or LinkedIn allows a person to produce a particular runner that adjoins them to their given family or musketeers or like- inclined individualities and allows them to feel happy and proud. Advanced sweats to limit the internet usage for order and connecting on a following, ethical, educational, safety, and fresh base have redounded from the shocking shift in gregarious authority. These events have redounded in legal and limited sweats to reduce the pitfalls associated with this new normal, which include fraud, pornography, hacking, and hacking while druggies are alone, thinker property, public security, and stoner time alone. In this setting, the current exploration trouble is free to probe the use of social community networking websites and cyber security regulations in an applicable manner. In the present exploration bid, 100 repliers (scholars at universities in Jaipur, Rajasthan, India) who constantly use collaborative media gear for winning performance of their day- to- day lives were the subject of exploratory and regular cave into slant for data compendium and psychoanalysis. The views of the repliers were statistically anatomized using SPSS's One- Way ANOVA, and the issues redounded in a negative response to the null thesis and a positive response to the alternate thesis, which states that- H1- There's a significant association between the use of social networking spots and legal violations. The current study can be attributed to some of the well- known cases that made captions. The purpose of this study was to establish a link between the position of the collaborative medium and the specifics or reason for the prevalence in exaggerated statutory businesses.

Comparative Analysis of Digital Economy in Lao PDR and Malaysia: An Overview

Widespread use of the internet and the development of high-speed computing have led to the emergence of a new economic structure known as the "digital economy." In ASEAN, the digital economic revolution has had tremendous growth rates. According to Think with Google, the Southeast Asian (SEA) internet economic worth increased by a staggering 40% between 2018 and 2019. Lao PDR and Malaysia as countries in ASEAN are facing a challenge on digital economy adoption. This paper analyses an overview of the digital economy in Lao PDR and Malaysia by 2019-2022. The paper methodology is based on a qualitative analysis of six major components: connectivity, privacy and cybersecurity policies, transformation, creation, and regional collaboration. Data collection gathered by literature review on relevant studies. The results of the studies showed a huge gap between Lao PDR and Malaysia in digital economy adoption according to mentioned benchmarking components. Infrastructure, regulation and cybersecurity are the main obstacles in implementing the digital economy in Lao PDR whereas Malaysia has yielded more results with tremendous growth in the digital economy sector on the contrary. The gap between Lao PDR and Malaysia has ignited urgent regional collaboration between both countries

Cyber-seaworthiness: A critical review of the literature

This paper provides a thorough literature review of maritime cyber-risks and the maritime cyber-security policy framework, focusing on the concept of seaworthiness. Policy instruments in force, do not focus on cyber-threats, and the industry addresses relevant challenges, with recommendations and expertise from third parties. Moreover, increased digitization of operations, as well as the advent of marine autonomous surface ships (MASS), imply higher relevant risks and require new mitigation strategies. This work demonstrates that the prevailing definitions of seaworthiness do not suffice in the contemporary context of operations characterized by a high degree of automation. In this regard, the term cyber-seaworthiness is newly introduced and defined with the aim of addressing the identified gaps. This novel approach shall enhance certainty levels to the industry and serve as a basis for future research, legal argumentation, as well as policy making.

Legal Mechanisms for the Stimulation of the Digital Economy in Developing Countries

Background: The digital economy has become a significant driver of economic growth in developing countries. However, to fully realise the benefits of the digital economy, legal mechanisms must be put in place to create an environment for its growth. Methods: This article provides an overview of legal mechanisms that can be implemented to stimulate a digital economy in developing countries. These legal mechanisms include the development of appropriate legal frameworks for e-commerce, intellectual property rights protection, privacy and data protection laws, and cybersecurity laws. Additionally, legal mechanisms that promote innovation and entrepreneurship, such as tax incentives, venture capital financing, and business incubators, are also essential. Results and conclusion: The implementation of legal mechanisms can help developing countries build a vibrant digital economy, create jobs, and improve the standard of living for their citizens.

Cybersecurity Law and Regulation in China: Securing the Smart State

Abstract Cybersecurity has become a key regulatory area in China’s rapidly digitizing society, economy, and state. The leadership deems it critical in providing adequate security guarantees for the realization of the ambitious “informatization” policy, symbolized by the passing of the Cybersecurity Law in 2016. Cybersecurity has also become integrated with overall national security, at a time when Chinese policy has become increasingly securitized. What, then, does this mean in practice? How do authorities conceive of cybersecurity and attempt to retrofit regulatory frameworks into an already well-established digital environment. This paper reviews the various components of the cybersecurity regime established by the Cybersecurity Law. It discusses how external circumstances have facilitated or obstructed the advance of regulation and implementation and demonstrates how cybersecurity is embedded in the broader processes of reform led by the Chinese Communist Party.

Representation of Iranian Cybersecurity Policy in the National Media

The relevance of the research topic is due to the increased attention to the problems of cybersecurity in the modern world. The purpose of the study is to identify the position of the Iranian authorities on the issue of cybersecurity. The main method of research is the analysis of the content of the Iranian online versions of newspapers, news websites and news agencies publishing information on this topic in Persian and English. As a result of the conducted research, the main conclusion is made that the majority of Iranian information publications focus on the positive aspects of cybersecurity policy aimed at protection against foreign interference in Iran’s internal affairs. At the same time, the study revealed a number of publications that highlight not only the advantages of the Iranian government’s cybersecurity policy, but also shortcomings and gaps.

Insider threats among Dutch SMEs: Nature and extent of incidents, and cyber security measures

Insider threats represent a latent risk to all organisations, whether they are large companies or Small or Medium-sized Enterprises (SMEs). Insiders, the individuals with privileged access to the assets of organisations, can compromise their proper functioning and cause serious consequences that can be direct—such as financial—or indirect—such as reputational. Insider incidents can have a negative impact on SMEs, as their resources are often limited, making it paramount to implement adequate cyber security measures. Despite its indisputable relevance, the empirical study of insider incidents from a criminological point of view has received little attention. This paper presents the results of an exploratory study that aims to understand the nature and extent of three types of insider incidents—malicious, negligent, and well-meaning—and how they are related to the adoption of cyber security measures. To that end, we administered a questionnaire among a panel of 496 Dutch SME entrepreneurs and managers and analysed the results quantitatively and qualitatively. The results show that although the prevalence of insider incidents is relatively low among Dutch SMEs, few organisations report a disproportionate number of incidents that often entail serious consequences. A regression model shows that there are cyber security measures related to both higher and lower incident likelihood. The implications of these findings for the cyber security policies of SMEs are discussed.

Comparing Canada's proposed Critical Cyber Systems Protection Act with cybersecurity legal requirements in the EU.

This article examines the Canadian federal government's proposed Critical Cyber Systems Protection Act (CCSPA), compares it with existing and proposed cybersecurity legal requirements in the European Union (EU), and sets out recommendations to address shortcomings of the proposed Canadian legislation. One of the cornerstone components of Bill C‑26, the CCSPA seeks to regulate critical cyber systems in federally regulated private sectors. It represents asignificant overhaul of Canadian cybersecurity regulation. However, the current proposed legislation exhibits many flaws, including acommitment to, and entrenchment of, apatchwork approach to regulation that focuses on formal registration; alack of oversight of its confidentiality provisions; aweak penalty scheme that focuses solely on compliance, not deterrence; and diluted conduct, reporting, and mitigation obligations. To repair these flaws, this article reviews the provisions of the proposed law and compares them with the EU's Directive Concerning Measures for aHigh Common Level of Security of Network and Information Systems Across the Union, the first EU-wide cybersecurity legislation, as well as its proposed successor, the NIS2 Directive. Where relevant, various other cybersecurity regulations in peer states are discussed. Specific recommendations are put forward.

Users are not stupid: Six cyber security pitfalls overturned

The skilled and dedicated professionals who strive to improve cyber security may unwittingly fall victim to misconceptions and pitfalls that hold other people back from reaching their full potential of being active partners in security. These pitfalls often reflect the cyber security community’s dependence on technology and failure to fully appreciate the human element. This paper offers cyber security professionals a primer so they can recognise and overcome six human element pitfalls in cyber security. In addition to gaining an awareness of these pitfalls, readers will learn about specific strategies on how to improve cyber security and empower users by addressing the human element in their organisations’ cyber security products, processes and policies.

(Re-)Configuring Federal Cybersecurity Regulation: From Critical Infrastructures to the Whole-of-the-Nation

Cyberattacks are one of the greatest threats to the United States’ national security. Facing an increase in cyberattacks, the current patchwork of federal cybersecurity regulations does not maximize the country’s ex ante defense that should protect the entire nation. This Article examines federal agencies’ involvement in promulgating cybersecurity regulations and Executive Branch cybersecurity actions, identifying three shortcomings in the current framework: (1) the nation lacks a general cybersecurity agency with regulatory and enforcement authority, (2) cybersecurity programs often rely on business participation and leadership without incorporating non-profit organizations and individuals, and (3) cybersecurity approaches often overemphasize the importance of attributing attacks to the corresponding culprits. To rectify these weaknesses and maximize cyber defense, this Article argues that Congress shouldexpand the Cybersecurity and Infrastructure Security Agency’s rulemaking and enforcement authority to monitor and mitigate cyber threats across varying sectors, including government, businesses, insurers, non-profit organizations, and individuals.

A multinational empirical study of perceived cyber barriers to automated vehicles deployment

The digital transformation of Automated Vehicles (AVs) has raised concerns in the cyber realm among prospective AV consumers. However, there is a dearth of empirical research on how cyber obstacles may impact the operation of AVs. To address this knowledge gap, this study examines the six critical cyber impediments (data privacy, AV connectivity, ITS infrastructure, lack of cybersecurity regulations, AV cybersecurity understanding, and AV cyber-insurance) that influence the deployment of AVs. The impact of gender, age, income level, and individual AV and cybersecurity knowledge on these obstacles are statistically assessed using a sample of 2061 adults from the United States, the United Kingdom, New Zealand, and Australia. The research revealed intriguing empirical findings on all cyber barriers in the form of a trichotomy: participants' education level, understanding of AVs, and cybersecurity knowledge. As education levels increase, the significance of a cyber barrier to AV deployment decreases; however, as AV comprehension and cybersecurity knowledge increase, the perception of a cyber barrier becomes significantly more important. In addition, the study demonstrates differences in perceptions of cyber barriers and AV deployments based on gender, age, income, and geographic location. This study's findings on cyber barriers and AV deployment have implications for academia and industry.

The Various Dimensions of Cyberthreats: (In)consistencies in the Global Regulation of Cybersecurity

The main aim of the present paper is to revisit the different dimensions of cyberthreats and to classify them on the basis of definitions and descriptions used in international instruments with a view to establish (in)consistencies between the various norms. In the framework of a larger project on this topic, we have selected a number of key instruments with the aim of comparing the various norm-descriptions and definitions. Yet, cybersecurity threats are difficult to classify because of the overlapping categories, and the fact that the activities can originate from an individual actor or from non-state actors and groups. This paper finds that, despite the quite fragmented regulatory systems around the world, there is to a very large extent agreement on the basic notions and definitions. La revolución de la información permite un acceso amplio y rápido a los datos, pero también permite o amplía la posibilidad de que terceros traten de dañar los sistemas y causar daños. A pesar de la creciente sofisticación de los ataques, el conocimiento técnico del usuario de hecho está disminuyendo. Eso puede explicarse por el hecho de que los scripts de ataque y los kits de herramientas están disponibles de manera asequible, con efectos devastadores para la sociedad. Cualquier ordenador con acceso a Internet, hoy en día es vulnerable a amenazas como virus, gusanos y otros ataques. Las amenazas a la ciberseguridad son difíciles de clasificar, ya que las diferentes categorías se superponen y las actividades pueden derivarse de un solo sujeto o de actores y grupos complejos y globales. Las amenazas cibernéticas se diferencian de los problemas de seguridad tradicionales, principalmente, en lo que respecta a la atribución de su jurisdicción, ya que un ataque cibernético se puede realizar desde cualquier lugar, sin que el actor tenga que salir de casa. En ese sentido, el enfoque principal del presente documento es revisar las diferentes dimensiones de las ciberamenazas y clasificarlas sobre la base de las definiciones y descripciones utilizadas en los instrumentos internacionales. Todo ello con el fin de establecer (in)coherencias entre las diversas normas. Nuestros hallazgos sugieren que, a pesar de los sistemas regulatorios bastante fragmentados en todo el mundo, existe un acuerdo general sobre las nociones y definiciones básicas. Esto ofrece un buen punto de partida para los debates en curso sobre una mayor armonización de las normas mundiales sobre ciberseguridad y la persecución del ciberdelito.

Strenthening trust and security in the EU cybersecurity policy

The present work deals with analyzing the legislation of Cybersecurity in the EU context. The European legislator has sought in recent years alongside foreign and defense policy to create an ad hoc order involving all the organs of the Union with the aim of tackling new types of crimes at European and international level. Our analysis seeks to address the new technological challenges and problems relating to cybersecurity by analyzing the acts of a binding or not nature of the Union which certainly show an application by the Member States that seems to be of a decisive nature for the evolution of the coming years of this sector as well as the demonstration that the EU rightly behaves in practice as a global player.

Defining the reporting threshold for a cybersecurity incident under the NIS Directive and the NIS 2 Directive

Abstract The NIS Directive and sector-specific cybersecurity regulations require the reporting of (security) incidents to supervisory authorities. Following the risk-based approach adopted in the NIS Directive, the NIS 2 Directive enlists as a basic security element the reporting of significant incidents that (i) have caused or (ii) are capable to cause harm, as well as (iii) notifying the service recipients of cyber threats. Although during the interinstitutional negotiations between the European Commission, the European Parliament, and the Council of the European there was consensus that the NIS Directive’s reporting framework needs to be reformed, views on the determination of what needs to be reported varied. This paper outlines and analyses the different concepts of a report-worthy significant incident that have been proposed during the legislative procedure for the NIS 2 Directive from a legal and policy perspective. Irrespective of further motives that may inhibit reporting, legal compliance is difficult to achieve where legal requirements are vague. In that regard, the difficulties to determine the reporting thresholds in the past and in the future are addressed. In consideration of the increased attack surface and threat scenario, it is argued that incidents where no harm has materialized should not be treated any different than incidents that have actually resulted in harm in order to acquire the envisaged full picture of the threat landscape and create value for business and society.

Outer Space, the Final Frontier of Cyberspace: Regulating Cybersecurity Issues in Two Interwoven Domains

ABSTRACT In the last decades, space activities have become more automated and digitized due to the technological development. As such, it is crucial to consider cyberspace and its risks to guarantee safety, security, and long-term sustainability of space activities, as well as to ensure that activities in outer space are carried out for the benefit of humankind. The paper assumes that both areas are global commons and numerous interactions exist between them, notably in terms of cybersecurity. Indeed, there is an increasing risk of attack against satellites, including interferences, jamming, and hacking, which reveals that the security aspects of satellite systems and data transmission cannot be overlooked, and the risk of cyberwarfare is real. Cybersecurity regulations at international, regional, and national levels to determine the potential elements applicable to space activities are examined in this paper. The paper stresses the need to bring together actors involved in the domain of cyber and in space activities with the aim to implement a structured, appropriated, and responsive regulatory framework to cyberthreats by considering the interdependence between these two areas. In this regard, it is argued that a compartmentalized approach with relation to cyber and outer space should be avoided.

Protection of personal data in China: Legislation in the digital age

In the development of China’s Internet industry and digital economy, great importance is attached to the protection of personal data and seriously protects the legitimate rights and interests of citizens’ personal data. Generally speaking, with the development of technology and industry, China’s personal data protection has gone from “indirect protection” to “direct protection” and then to “comprehensive protection”. In the early years of China’s Internet industry, the indirect protection of personal data was mainly achieved through the protection of the “rights to privacy” of citizens. Since the Internet industry of the People’s Republic of China has entered a stage of rapid development, the state began to directly protect personal data in accordance with the provisions of the Chapter “Network Information Security” established in the “Cyber Security Law” of 2016, establishes several principles for the collection and use of personal data, protection requirements information security. Until November 1, 2021, the “Personal Data Protection Law of the People’s Republic of China” (PPD) was adopted to comprehensively protect personal data, reflecting the ideology of development focused on bringing the people to the center, meeting the new needs and aspirations of the people in the new era, and also proposing the creation international digital legal order “Chinese version”. The PPD further expands the scope of the object of personal data protection, comprehensively establishes the rights of individuals to process data, strengthens the obligations to protect personal data processors, creates strict rules for the protection of sensitive personal data and regulates the processing of personal data by public authorities, as well as improving the means of legal protection of personal data, all of which are important points in the legislation. The law incorporates advanced foreign experience, while emphasizing Chinese wisdom, the spirit of the times, and practicality in accordance with the reality of China.

Factors Influencing Employees on Compliance with Cybersecurity Policies and Their Implications for Protection of Information and Technology Assets in Saudi Arabia

Factors Influencing Employees on Compliance with Cybersecurity Policies and Their Implications for Protection of Information and Technology Assets in Saudi Arabia

The Impact of the Russian-Ukrainian Hybrid War on the European Union's Cybersecurity Policies and Regulations

While Russia transitioned from hybrid to conventional warfare in Ukraine, NATO recognized cyberspace as another domain where allied response can be invoked. The European Union also decided to enhance the cybersecurity capabilities of the organization and its member states, making social resilience a priority area. It is recognized that the security of cyberspace and related systems is not just an economic issue but one that affects the whole society, necessitating a more complex strategy and regulation. The EU has taken steps to mitigate the cyber risks associated with hybrid warfare, enhancing network and cognitive security. However, offensive cyber operations could increasingly lead to open armed conflict. During existing conflicts, some cyber operations may undermine public confidence and further escalate the situation. The EU and its Member States must pay closer attention to escalation dynamics in their legislation and practices. It is crucial to scrutinize cyber policies, set specific targets and deadlines, and regularly update them. This will require stakeholders to find the appropriate regulatory levels and align national regulations, practices, and standards.

South Korea’s national approaches to information data management

This article examines South Korea’s main policy related to online authentication and data access control, having major changes and the reasons behind them. It analyzes the driving forces of this policy such as Korea’s ICT policy, cybersecurity incidents, and cybersecurity policy. It presents the features of the development of the online authentication process and touches upon the problems of data access control. The article considers digital new projects of South Korea aimed at the development of a digital society. South Korea’s digital environment is one of the most advanced ones in the world. The digitalization of society has intensified even more with the division of society into before and after the Covid-19 pandemic, which showed the level of development of each state in the field of digital technology. National approaches and cybersecurity have become an element of the successful promotion of South Korea’s digitalization policy.In conclusion, the importance of developing the digital environment according to a certain country-specific model is outlined, and it is considered as an important modern tool in the process of implementing the development of a unique digital environment