Cybersecurity Standards Research Articles

Importance of Cybersecurity/The Relevance of Cybersecurity to Diabetes Devices: An Update from Diabetes Technology Society.

As medical devices become more integrated with wireless technologies, the risks of cyberattacks and data breaches increase, making stringent cybersecurity measures essential. The implementation of rigorous cybersecurity standards is essential for enhancing the cybersecurity of devices. This article examines the evolving cyber threats faced by the medical technology industry, the role of IEEE 2621 in providing comprehensive security benchmarks for medical devices, and the need for continuous risk assessments and adherence to regulatory standards to mitigate future cyber risks. Adherence to cybersecurity standards establishes ensures the effective protection of sensitive data and critical infrastructure.

The Role of AI in Shaping Global Healthcare Cybersecurity Policies

This comprehensive article explores the transformative role of Artificial Intelligence (AI) in shaping global healthcare cybersecurity policies. It examines the rapid growth of the healthcare cybersecurity market and the increasing prevalence of cyber threats in the sector. The article delves into AI's influence on international regulations, cybersecurity standards, and global cooperation initiatives. It analyzes the geopolitical implications of AI-driven cybersecurity, including national strategies, technology transfer policies, and digital sovereignty concerns. The article also addresses key challenges and future directions, such as mitigating AI bias, preparing for quantum computing threats, and optimizing human-AI collaboration in cybersecurity. Through an in-depth examination of these critical issues, the article provides a holistic overview of AI's impact on the future of healthcare cybersecurity on a global scale.

Challenges in Maritime Cybersecurity Training and Compliance

The implementation of cybersecurity standards and directives in the maritime sector plays a crucial role in protecting critical maritime infrastructures from cyber threats. The level of protection depends heavily on humans. However, the effectiveness of cybersecurity training and compliance programmes, an essential component of these standards, is often hindered by challenges related to the sector’s environment, including the established technologies, practices, and norms. This paper aims to identify these challenges through a literature review and set the basis for more effective human risk minimization, responses, and training. We identify 17 challenges and validate them with an online survey (N = 205) capturing real-world perspectives from maritime-related stakeholders. Our findings contribute to enhancing the effectiveness of maritime cybersecurity training and compliance programmes, ultimately strengthening the maritime cybersecurity posture.

Cybersecurity Certification Requirements for Distributed Energy Resources: A Survey of SunSpec Alliance Standards

This survey paper explores the cybersecurity certification requirements defined by the SunSpec Alliance for Distributed Energy Resource (DER) devices, focusing on aspects such as software updates, device communications, authentication mechanisms, device security, logging, and test procedures. The SunSpec cybersecurity standards mandate support for remote and automated software updates, secure communication protocols, stringent authentication practices, and robust logging mechanisms to ensure operational integrity. Furthermore, the paper discusses the implementation of the SAE J3072 standard using the IEEE 2030.5 protocol, emphasizing the secure interactions between electric vehicle supply equipment (EVSE) and plug-in electric vehicles (PEVs) for functionalities like vehicle-to-grid (V2G) capabilities. This research also examines the SunSpec Modbus standard, which enhances the interoperability among DER system components, facilitating compliance with grid interconnection standards. This paper also analyzes the existing SunSpec Device Information Models, which standardize data exchange formats for DER systems across communication interfaces. Finally, this paper concludes with a detailed discussion of the energy storage cybersecurity specification and the blockchain cybersecurity requirements as proposed by SunSpec Alliance.

An Overview of Information and Cyber Security Standards

Advances in digitalization, particularly those regarding cyber-physical systems (CPS) have stimulated the adoption of digital capabilities such as Industrial IoT, machine learning, cloud services, and the use of digital twins. The increased digital sophistication of CPS is not without risk, particularly regarding the potential for information/cyber security incidents. Whilst the need for security of enterprise information security is not new, A significant challenge is understanding what security standards may be available and applicable when developing security controls and technical measures to protect CPS. This paper explores what research is available regarding the choice and comparison of information/cyber security standards. It provides a snapshot of the security standards landscape at the start of 2024. Issues relating to development and adoption of security standards are examined, illustrated using inconsistencies in language regarding three key terms: availability, integrity, and confidentiality.

CYBER SECURITY FOR POWER GRIDS: THREATS, MITIGATION, AND FUTURE OUTLOOK

Cybersecurity is often confused with information security, although the latter focuses on human involvement, while the former sees individuals as potential targets and considers this an additional dimension. Cybersecurity discussions highlight important ethical issues impacting society and have led to the development of various frameworks addressing challenges like workforce development and personal data protection. This paper reviews these models, their limitations, and past mitigation techniques while offering future research recommendations. It explores vulnerabilities in wireless communication systems, the evolving nature of cyberattacks, quantum cryptography, and advanced key management schemes. Furthermore, it emphasizes the growing cybersecurity risks in power grids due to the integration of computing and communication capabilities into cyber-physical systems (CPS). A notable example is the 2015 cyberattack on Ukraine's power grid, illustrating the urgent need for improved security. This paper presents a comprehensive review of cybersecurity standards, emerging threats, and challenges in power systems. Index Terms—Cybersecurity, Cyber Threats frameworks, workforces, threats, techniques web 3.0, Implications

Development of cybersecurity framework for FinTech innovations: Bahrain as a case study

FinTech is the term used to refer to financial and technology convergence space solutions. It usually refers to new innovations that conduct or connect with financial services via the internet, smart devices, software applications, or cloud services and encompasses anything from mobile banking to cryptocurrency applications. Despite the advantages of FinTech, cybercriminals seized the opportunity to exploit vulnerabilities in FinTech systems. Phishing attacks, ransomware, and data breaches have become more prevalent, targeting individuals and FinTech institutions. Bahrain, which is not different from the rest of the world, was impacted by such cyber threats. Thus, FinTech companies have had to strengthen their cybersecurity countermeasures and protocols to combat these threats.Existing countermeasures in the literature primarily focus on general cybersecurity practices and frameworks, with limited attention given to the specific needs of the FinTech industry. Hence, there is a notable gap in the literature regarding a focused cybersecurity framework that caters to the unique requirements of FinTech innovations, especially in Bahrain. To bridge this gap, this research addresses the problem by conducting an extensive review of existing cybersecurity challenges, common practices, and cybersecurity standards and through in-depth research interviews with executives, experts, and other FinTech business stakeholders. Leveraging this knowledge, this research proposed an adaptable framework that addresses the risks and vulnerabilities faced by FinTech innovations in Bahrain.Through panel discussions and Delphi sessions, industry experts evaluated the framework’s practical feasibility, ability to address specific risks, and compatibility with the existing FinTech regulatory landscape. The results demonstrate a high acceptance of the developed framework and highlight the framework’s potential to enhance cybersecurity resilience significantly. Moreover, the experts acknowledge the proposed framework as a fundamental baseline in securing the FinTech ecosystem in Bahrain. The importance of this research lies in its potential to enhance the cybersecurity posture of the FinTech industry in Bahrain, mitigating risks and vulnerabilities associated with cyber threats in this vital sector.

Comprehensive review of smart city cybersecurity strategies

With cities rapidly advancing technologically, the rise of smart cities brings innovative solutions to urban challenges. However, this integration of technologies within urban infrastructures introduces new cybersecurity risks. This review explores the cybersecurity issues that smart cities face and discusses strategies to address these threats. Smart cities rely on interconnected networks of devices and systems to enhance efficiency, sustainability, and citizen services. Yet, this connectivity also creates a complex environment that is vulnerable to cyberattacks. A key concern is the wide array of IoT devices deployed across smart city infrastructures, which often lack robust security mechanisms, making them susceptible to exploitation by cybercriminals. The interconnected nature of these systems heightens the potential impact of cyberattacks, posing significant risks to critical infrastructure, public safety, and privacy. Threat actors can exploit vulnerabilities in interconnected systems, disrupting essential services, manipulating data, or even causing physical harm. Since smart cities heavily depend on data-driven decision-making, ensuring data integrity and confidentiality is a top priority. To mitigate these risks, various cybersecurity strategies have been proposed and implemented. These include technical solutions, regulatory frameworks, and collaboration among stakeholders. Technical measures like encryption, authentication mechanisms, intrusion detection systems, and secure software development practices are essential. Additionally, strong access controls and network segmentation can limit the scope of potential attacks. Regulatory initiatives also play a crucial role in improving cybersecurity standards and ensuring compliance among stakeholders. Establishing clear guidelines for data protection, privacy rights, and incident response protocols is vital for safeguarding citizens' interests. Collaborative efforts between government agencies, the private sector, academia, and cybersecurity experts are crucial in sharing information and collectively defending against emerging threats. Securing smart cities requires a comprehensive approach that integrates technical measures, regulatory frameworks, and collaborative efforts to create a resilient and secure urban environment for all citizens. Keywords: Cybersecurity, Smart City, AI, Technology, Security.

Evaluation of SDN security measures in the context of IEC 62443-3-3

The security of assets within electrical substations is paramount to ensuring the reliable and resilient operation of the energy sector. However, implementing existing industry cybersecurity standards in these environments presents numerous technical challenges. In this work, we provide systematic guidance that emphasizes best practices and prioritizes requirement implementation. We examine the application of Software-Defined Networking (SDN) as a means to enhance security within the IEC 62443 family of standards. Specifically, we offer insights into how the security measures required for compliance with the IEC 62443 security standards can impact the stringent timing constraints of contemporary communication protocols, enabling advanced distribution system operations in the future. Utilizing a testbed modeled after a real-world electrical substation, we demonstrate that while SDN-based security features naturally introduce some additional latency, their operational impact on the network’s strict constraints is minimal.

Design and Development of Cybersecurity Suite

Protecting personal, corporate and government data in the digital age requires cybersecurity. Traditional cybersecurity methods sometimes lack comprehensive and dynamic protection mechanisms as cyber-attacks change and become more sophisticated. A new cybersecurity suite is proposed in this study. It integrates various advanced security technologies into a single user-friendly platform interaction. This paper specifically combines techniques for real-time phishing detection, strong password management, safe encryption and decryption services and an interactive module to promote user awareness and behaviours to improve digital security for individuals and organization. Rapid prototyping is used in iterative and incremental development phases to adapt to changing security needs and user input. This method allows the platform to be constantly improved to satisfy the current cybersecurity standards and react to new threats. The prototyped developed provides proactive digital defence, a complete cybersecurity platform that equips users to defend their digital presence. With the intuitive design and advanced feature set, the prototype aspires to democratize cybersecurity. Empirical testing of the prototype revealed that makes an effective protection of a wider audience without the complexities of security software. This paper contributes in the advances cybersecurity technology and shaping the digital protection measures.

Соціальна інженерія як загроза кібербезпеці: методи запобігання та захисту

The relevance of the study of social engineering is due to the ever-growing number of cyberattacks that use the human factor as the main penetration vector. Attackers, using various methods such as phishing, vishing, pretexting, and others, cause significant damage to organisations by stealing confidential data, undermining reputation, and disrupting the smooth operation of business processes. The growth of social engineering-related cyberattacks requires improving the legal framework and developing new cybersecurity standards. The article analyses modern methods of social engineering, their impact on information systems and organisations, and identifies the main areas of protection against these threats. Particular attention is paid to the role of the human factor in cybersecurity and the need for an integrated approach that combines technical, organisational and educational measures. Particular attention is paid to the challenges associated with the human factor in cybersecurity systems, as well as the importance of an integrated approach to combating these threats. The author substantiates the need to integrate cybersecurity education and training programmes to reduce the risk of successful social engineering attacks. Prospects for further research are identified, in particular in the development of interactive training programmes to raise user awareness and the development of new algorithms for the automatic detection of social attack attempts

Review of methodology for conducting cybersecurity audits for compliance with standards

This study focuses on the analysis of conducting cybersecurity audits, providing a generalized view of this process. The main attention is given to analyzing the stages of conducting cybersecurity audits and methods of information collection. Special emphasis is placed on the development and implementation of sensor systems capable of withstanding high pressure and corrosion in underwater environments, as well as providing accurate and reliable data. The work covers theoretical aspects of conducting audits, including defining objectives, scope, and type of audit, planning, evidence collection, and evaluating compliance with cybersecurity standards. This research highlights the importance of corrective actions by the organization after the audit, as without this step, the process is almost entirely meaningless.

Cyber Security – Current and Future Trends

During recent years, many researchers and professionals have revealed the endangerment of wireless communication technologies and systems from various cyberattacks, these attacks cause detriment and harm not only to private enterprises but to the government organizations as well. The attackers endeavor new techniques to challenge the security frameworks, use powerful tools and tricks to break any sized keys, security of private and sensitive data is in the stale mark. There are many advancements being developed to mitigate these attacks. In this conjunction, this paper gives a complete account of survey and review of the various exiting advanced cyber security standards along with challenges faced by the cyber security domain. The new generation attacks are discussed and documented in detail and the advanced key management schemes are also depicted. The quantum cryptography is discussed with its merits and future scope of the same. Overall, the paper would be a kind of technical report to the new researchers to get acquainted with the recent advancements in Cyber security domain.

Railway Infrastructure Cybersecurity: An Overview

The railway infrastructure constitutes a type of operational technology (OT)-based critical infrastructure, which is expected to work 24x7, 365 days a year, and where the life expectancy of operational equipment often exceeds 30 years. In this domain, an operational anomaly compromising the OT system can cause a train accident or interrupt traffic, with potentially significant impact in terms of business as well as for passenger safety. Due to their relevance, railways are strategic assets of national interest and, consequently, targets of interest for cybercriminals and cyberwarfare activities. For instance, service interruptions may trigger ripple effects resulting in product shortages and widespread supply chain disruptions, with severe impacts for both the economy and national security. In a bid to optimise and streamline operations. the railway industry has recently started taking a series of significant steps towards digitization, with infrastructures experiencing a significant paradigm shift which, for instance, makes it possible to have centralised interlockings and Radio Block Centre (RBC) for an entire country, with geographical redundancy, ensuring the utmost availability and punctuality by moving the control logic to the cloud. Nevertheless, these developments must always be carried on within the scope of established cybersecurity standards and frameworks. This paper presents an analysis of the state of the art on railway cybersecurity, focused on the existing solutions based on the application of the CENELEC “Technical specification 50701 - Railway Application – Cybersecurity”, which is currently the latest European specification addressing railways, being designed to help suppliers, integrators, and operators to implement a cybersecurity risk assessment plan, the necessary controls, and the management of the complete system life cycle. Special attention will be paid to the conduit between the rail signal interlocking system, that controls the line signalling, and the Automatic Train Supervision (ATS) that runs in the Operational Control Centre (OCC), as this has been identified by the European Union Agency for Cybersecurity (ENISA) as one of the most critical systems identified by the operators of essential services.

Digital transformation in SMEs: Identifying cybersecurity risks and developing effective mitigation strategies

This study delves into the cybersecurity landscape for small and medium-sized enterprises (SMEs), focusing on identifying prevalent cybersecurity risks, evaluating existing mitigation strategies, and exploring the role of innovation and technology in bolstering cyber resilience. Employing a systematic literature review and content analysis, the research scrutinizes academic journals, industry reports, and government publications from 2015 to 2024, to gather insights into the cybersecurity challenges and strategies pertinent to SMEs. Key findings reveal that SMEs are particularly vulnerable to a range of cyber threats, including phishing, malware, data breaches, and ransomware, primarily due to resource constraints, lack of awareness, and inadequate cybersecurity measures. Effective mitigation strategies highlighted include the adoption of comprehensive cybersecurity policies, regular employee training, and the implementation of advanced technological solutions. The study predicts an increasing reliance on artificial intelligence and machine learning for threat detection, alongside a growing trend of collaboration between SMEs and cybersecurity firms. The research underscores the necessity for supportive policies and frameworks that encourage SMEs to strengthen their cybersecurity posture, recommending financial incentives and the development of SME-specific cybersecurity standards. Building a cyber-secure culture within SMEs, characterized by organizational commitment and regular awareness programs, is identified as crucial for enhancing cyber resilience. Finally, the study emphasizes the importance of cybersecurity for SMEs, offering strategic recommendations for navigating digital threats and suggesting avenues for future research, including the exploration of behavioral aspects of cybersecurity and the impact of emerging technologies.

Cybersecurity compliance in financial institutions: A comparative analysis of global standards and regulations

Cybersecurity is a critical concern for financial institutions worldwide, given the increasing frequency and sophistication of cyberattacks. This paper conducts a comparative analysis of global standards and regulations governing cybersecurity compliance in financial institutions. By examining the regulatory frameworks of key jurisdictions, including the United States, the European Union, and Asia-Pacific countries, this study aims to identify common trends, differences, and best practices in cybersecurity compliance. The analysis begins by outlining the regulatory landscape for cybersecurity in financial institutions, highlighting the key objectives and principles underlying these regulations. It then compares the regulatory frameworks of different regions, focusing on areas such as data protection, incident response, and risk management. By examining the specific requirements and guidelines set forth by each jurisdiction, this study identifies the strengths and weaknesses of current cybersecurity regulations and offers recommendations for enhancing compliance and resilience. One of the key findings of this study is the increasing convergence of global cybersecurity standards, driven by the interconnected nature of the financial sector and the need for harmonized regulatory approaches. While differences in regulatory frameworks still exist, particularly in areas such as data protection and breach notification, there is a growing recognition of the need for international cooperation and information sharing to combat cyber threats effectively. The study also highlights the challenges faced by financial institutions in achieving cybersecurity compliance, including resource constraints, evolving cyber threats, and the complexity of regulatory requirements. It underscores the importance of implementing robust cybersecurity measures, such as encryption, multi-factor authentication, and regular security audits, to mitigate these challenges. In conclusion, this comparative analysis provides valuable insights into the global landscape of cybersecurity compliance in financial institutions. By identifying common trends and best practices, this study aims to assist policymakers, regulators, and financial institutions in enhancing their cybersecurity posture and effectively addressing the evolving cyber threat landscape.

A taxonomy for cybersecurity standards

Cybersecurity standards on a global scale are exhaustive, appealing to several types, such as glossaries, guidelines, methods, and objectives (e.g., Information Technology evaluation, requirement identification, risk management, and technical specifications). This chaotic range of standards towards the rapid pace of technological and threat evolution hinders stakeholders (e.g., security architects/developers, policymakers, testers, and auditors) from discovering which standards best meet their security needs. The paper analyzes this challenge and contributes to harmonizing standards by identifying relationships between the EU regulation and prominent cybersecurity standards. The current work develops a taxonomy that classifies cybersecurity standards according to their objective, usage, and sector, aiming to help stakeholders understand their purpose and decide which they should adopt to cover their organizational needs. The taxonomy is represented in a semantic ontology, following the Web Ontology Language Edition 2 knowledge engineering approach. A realistic scenario is described to illustrate the applicability of the taxonomy.

Security risk models against attacks in smart grid using big data and artificial intelligence.

The need to update the electrical infrastructure led directly to the idea of smart grids (SG). Modern security technologies are almost perfect for detecting and preventing numerous attacks on the smart grid. They are unable to meet the challenging cyber security standards, nevertheless. We need many methods and techniques to effectively defend against cyber threats. Therefore, a more flexible approach is required to assess data sets and identify hidden risks. This is possible for vast amounts of data due to recent developments in artificial intelligence, machine learning, and deep learning. Due to adaptable base behavior models, machine learning can recognize new and unexpected attacks. Security will be significantly improved by combining new and previously released data sets with machine learning and predictive analytics. Artificial Intelligence (AI) and big data are used to learn more about the current situation and potential solutions for cybersecurity issues with smart grids. This article focuses on different types of attacks on the smart grid. Furthermore, it also focuses on the different challenges of AI in the smart grid. It also focuses on using big data in smart grids and other applications like healthcare. Finally, a solution to smart grid security issues using artificial intelligence and big data methods is discussed. In the end, some possible future directions are also discussed in this article. Researchers and graduate students are the audience of our article.

ASSESSMENT OF ESP32 MICROCONTROLLER COMPLIANCE WITH INTERNATIONAL STANDARDS OF CYBER SECURITY FOR INTERNET OF THINGS

The protection of the ESP32 microcontroller from cyber threats is studied by analyzing the compliance of the platform (microcontroller, OS, API, manufacturer support) with the requirements of international cybersecurity standards. In particular, the following topics are covered: means to manage reports of vulnerabilities, keeping software updated, securely storing sensitive security parameters, secure communication, and protecting personal data. Generally, it is concluded that the ESP32 microcontroller meets the cybersecurity standards of the Internet of Things. The only one exception that was found is the ESP32 manufacturer does not publish its vulnerability disclosure policy. Thus cybersecurity level of ESP32 platform should be considered as a quite high to produce a regular, household IoT system.

Integrated cybersecurity for metaverse systems operating with artificial intelligence, blockchains, and cloud computing

In the ever-evolving realm of cybersecurity, the increasing integration of Metaverse systems with cutting-edge technologies such as Artificial Intelligence (AI), Blockchain, and Cloud Computing presents a host of new opportunities alongside significant challenges. This article employs a methodological approach that combines an extensive literature review with focused case study analyses to examine the changing cybersecurity landscape within these intersecting domains. The emphasis is particularly on the Metaverse, exploring its current state of cybersecurity, potential future developments, and the influential roles of AI, blockchain, and cloud technologies. Our thorough investigation assesses a range of cybersecurity standards and frameworks to determine their effectiveness in managing the risks associated with these emerging technologies. Special focus is directed towards the rapidly evolving digital economy of the Metaverse, investigating how AI and blockchain can enhance its cybersecurity infrastructure whilst acknowledging the complexities introduced by cloud computing. The results highlight significant gaps in existing standards and a clear necessity for regulatory advancements, particularly concerning blockchain’s capability for self-governance and the early-stage development of the Metaverse. The article underscores the need for proactive regulatory involvement, stressing the importance of cybersecurity experts and policymakers adapting and preparing for the swift advancement of these technologies. Ultimately, this study offers a comprehensive overview of the current scenario, foresees future challenges, and suggests strategic directions for integrated cybersecurity within Metaverse systems utilising AI, blockchain, and cloud computing.