Cybersecurity Team Research Articles

Assessing Employee Susceptibility to Cybersecurity Risks

This research challenges assumptions about cybersecurity risk factors, revealing that age, gender, and educational background are not significant determinants of employee susceptibility. It highlights the importance of inclusive cybersecurity training programs that cater to individuals of all age groups, dispelling the misconception that older employees are inherently less tech-savvy and more susceptible to cybersecurity threats. The findings show that cybersecurity teams within organizations significantly impact the adoption of security policies and data handling practices among employees, even though their influence on password and account security practices is limited. Organizations can adopt a holistic approach to cybersecurity training and awareness programs by leveraging these insights. This approach transcends traditional demographics and focuses on enhancing password and account security, ultimately strengthening cybersecurity postures, fostering a culture of cybersecurity consciousness, and fortifying defenses against the evolving landscape of digital threats.

Malware Detection Using Artificial Intelligence: Techniques, Research Issues and Future Directions

Artificial intelligence (AI) is an effective technology used for upgrading the security posture against a variety of security challenges and cyber-attacks that cyber security teams may use. Malware is a software which aims to access a device without the explicit permission of its owner. Forensics investigations report that many organizations have encountered unusual records, collected by their antiviral security monitoring systems. Most of their arrangements skeptically pass a large amount of diplomatic data through various unethical strategies that make malware identification tougher. However, these procedures have varied limitations that call for an unused inquiry about the track. This study explores the complex relationship between malware detection and AI [1]. This paper provides insights into performance evaluation metrics and discusses several research issues that impede the effectiveness of existing techniques. The study also provides recommendations for future research directions and is a valuable resource for researchers and practitioners working in the field of malware detection.

Keamanan siber sebagai fondasi pengembangan aplikasi keuangan mobile: Studi literatur mengenai cybercrime dan mitigasinya

This study examines the importance of cybersecurity in mobile financial applications, particularly in the face of rising cybercrime threats. The aim of this research is to provide deeper insights into the significance of cybersecurity in mobile financial apps and to develop approaches that financial companies can adopt to protect their users' data and information. The research employs a qualitative descriptive method using a systematic literature review (SLR) approach. Meta-synthesis analysis is applied to synthesize data from 26 journal articles published between 2019 and 2024. The findings reveal that cybercrime in the financial and FinTech industries is driven by internal factors such as weak security systems, lack of system updates, limited human resource competencies, and careless user behavior. External factors include malware attacks, unclear regulations, and the use of advanced technology. To counter these, it is necessary to implement technologies such as firewalls and blockchain, strong risk management, enhanced network infrastructure, the establishment of cybersecurity teams, the development of clear regulations, and user education to raise awareness and improve cybersecurity. Therefore, the implementation of a comprehensive cybersecurity strategy is crucial in maintaining the integrity and trust of users in mobile financial applications.

Resilience and risk management in cybersecurity: A grounded theory study of emotional, psychological, and organizational dynamics

This Grounded Theory examines the in-depth dynamics of cybersecurity professionals working in financial organizations regarding stress management, risk handling, communication challenges, and perceived benefits from work. This study conducted a grounded theory approach with cybersecurity professionals through in-depth interviews to comprehensively understand these dynamics. The findings identify critical themes about emotional and psychological resilience, effective risk management strategies, overcoming communication challenges, and recognizing organizational and personal benefits from robust cybersecurity practices. The current research highlights that for better well-being and performance of cybersecurity teams, extensive support systems, proactive risk management, and communication are very important and should be embedded within organizations. By utilizing the grounded theory, this study offers a nuanced exploration of the complex and entwined factors that impact daily operations and the overall effectiveness of cybersecurity professionals, offering valuable insights for improving organizational policies and creating a supportive work environment. These findings suggest, most importantly, that robust support systems, risk assessments, clear communication protocols, and training opportunities should be developed and operationalized in financial organizations to help professionals reduce stress at work and strengthen resilience factors. Not only does this research project cover significant gaps in the literature, but it also really helps financial organizations further improve their currently existing cybersecurity strategies to better support personnel by using this framework.

Cyber Security Threats to Iran and its Countermeasures: Defensive and Offensive Cyber Strategies

Iran's convoluted geopolitical status, its centrality to locale-specific wars, plus the shifting balance of the global order make cyber security a key issue worldwide in addition to traditional security challenges. Iran is an appealing target for cyber enemies due to its numerous security vulnerabilities, which include ransomware infection, scams, as well as complicated malware. Iran has taken a flexible stance, via collaboration, authorized, and intellectual tactics to counter these concerns. Forming cyber security teams, utilizing the latest innovations, and hiring competent employees are all examples of efforts in cyber defense. Legislative structures are essential for bringing criminals before the law and discouraging unlawful behaviour, but the dynamic nature of cyber threats makes it difficult to update rules. The goal is to keep information security and safety measures under check. The identification and mitigation of cyber dangers necessitate collaboration with various nations, global organizations, and corporations. Iran's cyberspace involvement shapes societal sentiment and upholds the will of the people, with both advantageous and hazardous repercussions. To bolster its application and balance its powerful adversaries, it employs cyber assaults in conjunction with conventional asymmetrical combat strategies. What is Iran's main cyber security concerns and challenges, and how is Iran addressing as well as tackling them, is the question that this study aims to answer.

Modeling Cybersecurity Operations to Improve Resilience

AbstractIn this paper, we explore the concept of operational resilience of a network or system of computer systems, focusing on the processes of a cybersecurity team within the multi‐disciplinary network security operations center. The computer system under examination has faced a cyber‐attack that has reduced its capability. The organization's reputation is damaged temporarily but can be restored if the network security operations center can quickly restore the organization's ability to produce desired results. After a cyber‐attack, we examine the processes for restoring the system's capability to its original level. These processes will happen sequentially and require close coordination of the cybersecurity team members. We examine a balanced and adaptive assignment policy within the cybersecurity organization to the various processes, showing how these policies can impact the speed with which the system's capability can be restored. Our findings reveal that the adaptive assignment policy among the team members can increase the system restoration rate even though recovering the complete capability of the system may be the same.

A method of using modern endpoint detection and response (EDR) systems to protect against complex attacks

The subject of the research in this article is the architecture of Endpoint Detection and Response and the EDR agent as their base parts in terms of mechanisms for detecting and countering complex attacks on information and communication systems (ICS). The aim of the work is to develop of method for improving the efficiency of using Endpoint Detection and Response (EDR) to reduce the risks of compromising ICS information, industrial, and infrastructure objects by effectively redistributing and utilizing the available EDR mechanisms, the cybersecurity team, and other resources available for implementing security measures in an enterprise, institution, or organization. The article addresses the following tasks: reviewing and analyzing existing EDR systems, analyzing the architecture of EDR solutions and EDR agents, the features of their use, the logic behind the construction of methods and mechanisms for detecting threats to the system from malicious actors and malicious code. The task of providing recommendations for the organization of ICS is also separately addressed in terms of the need to protect the entire ICS and its individual elements, as well as in terms of the available resources (the cybersecurity team, their qualifications and level of awareness of the architecture of EDR solutions) and means (available EDR system elements) for organizing protection. The following methods are used: modeling attack mechanisms, modeling attacker behavior. The following results were obtained: general and specific recommendations were formulated for optimizing the operation of EDR systems and ensuring the effective use of EDR system elements in the information and communication networks of enterprises, organizations, and institutions of various types and orientations depending on the available resources and the information requiring protection. Conclusions: The identified recommendations for the application of EDR mechanisms for protecting information systems and networks allow optimizing the costs of creating a protection infrastructure and implementing security measures, taking into account the characteristics of the available tools and the training and awareness of the cybersecurity team both in terms of response time to threats and the complexity and cost of performing protection tasks.

Enhancing Threat Prioritization In Cybersecurity Using Avian Shield Optimizer (ASO) In Graph Forge Elite (GFE) Framework

In the ever-evolving field of cybersecurity, the ability to effectively prioritize threats is essential for organizations to allocate resources wisely and proactively mitigate potential risks. Avian Shield Optimizer (ASO) is a revolutionary optimization technique specifically designed for threat prioritization. ASO utilizes evolutionary-inspired mechanisms to dynamically adjust the prioritization of threats based on a comprehensive analysis of factors such as severity, relevance, and potential impact on organizational assets. By continuously monitoring and adapting to the dynamic threat landscape, ASO enables organizations to anticipate and respond quickly to emerging threats, ensuring that resources are allocated appropriately to address the most critical vulnerabilities. Moreover, ASO seamlessly integrates with existing threat intelligence platforms, providing cybersecurity teams with actionable insights and recommendations to comprehensively strengthen their defense strategies. Concurrently, the GraphForgeElite framework enhances this approach by facilitating the analysis of complex network data connections and structures, enabling the detection of subtle irregularities that may indicate potential cyber threats. ASO collaborates synergistically with GraphForgeElite, utilizing evolutionary-inspired methodologies to dynamically adapt the framework's design and settings, automatically tuning the parameters. Through rigorous experimentation, the performance of ASO-GraphForgeElite's Network is compared to other state-of-the-art classifiers. The results demonstrate the superior performance of ASO-GraphForgeElite's Network, surpassing 99% accuracy, precision, recall, and F1-score. Additionally, the framework exhibits efficiency in handling complex network data structures, enabling the identification of subtle patterns that indicate potential threats.

Enhancing awareness of cyber crime: a crucial element in confronting the challenges of hybrid warfare In Indonesia

The Cyber Defense Center, abbreviated as Pushansiber, is an institution responsible for carrying out the duties and functions of the Defense Strategic Installation Agency. Pushansiber has an important role in implementing governance, cooperation, operations, and ensuring cyber defense security. However, this year there has been an increase in problems related to cyber attacks, such as phishing, malware, ransomware, spam. These cyber attacks are included in the concept of hybrid warfare which is believed to be a form of conflict that involves the utilization of various elements, one of which is cyber attacks, military, political, economic, and information aspects. This causes conflict situations to be complicated and demands a comprehensive approach in terms of defense and handling, with digital literacy and cybersecurity awareness which has an important role in defense management, the need for awareness and training, simulation, and certification to strengthen cybercrime awareness in every organization. The success of other countries that have established specialized cybersecurity teams and invested in advanced technology can serve as an example for Indonesia. For Indonesia, the cooperation between National Cyber and Crypto Agency (BSSN) and the Ministry of Defense in strengthening cybersecurity capabilities is an important step to safeguard infrastructure, protect sensitive data, and reduce potential disruptions from malicious cyber activities with the aim of strengthening cybersecurity capabilities.

A Cybersecurity Analysis of Construction Sites in Abuja, Nigeria

This research delves into the cybersecurity vulnerabilities of construction sites in Abuja, Nigeria, within the context of Construction 4.0 advancements. Recognizing the growing risk of cyber threats in the industry, the research explores the critical intersection of emerging technologies and effective cybersecurity practices. The central tenet of the research is the urgent need for robust cybersecurity measures in light of the construction sector's inherent susceptibility to cyberattacks. Employing a mixed-methods approach, including semi-structured interviews to guide the development of surveys conducted with 323 participants carefully selected using stratified sampling, the research comprehensively analyzes the current state of cybersecurity practices within Abuja's construction landscape. Key findings reveal intricate dynamics of cybersecurity preparedness across different industry segments. Notably, 0% of the surveyed participants reported dedicated cybersecurity teams and minimal training on vulnerabilities was conducted. The analysis identifies a lack of correlation between years of experience and digital adoption with the implementation of cybersecurity best practices. Underscoring the crucial role of cybersecurity in Construction 4.0 initiatives, the research emphasizes the need for tailored strategies and policies specific to the Nigerian context. Recommendations advocate for collaborative efforts, enhanced knowledge-sharing, and strategic investments to fortify the sector against evolving cyber threats.

Boosting Holistic Cybersecurity Awareness with Outsourced Wide-Scope CyberSOC: A Generalization from a Spanish Public Organization Study

Public sector organizations are facing an escalating challenge with the increasing volume and complexity of cyberattacks, which disrupt essential public services and jeopardize citizen data and privacy. Effective cybersecurity management has become an urgent necessity. To combat these threats comprehensively, the active involvement of all functional areas is crucial, necessitating a heightened holistic cybersecurity awareness among tactical and operational teams responsible for implementing security measures. Public entities face various challenges in maintaining this awareness, including difficulties in building a skilled cybersecurity workforce, coordinating mixed internal and external teams, and adapting to the outsourcing trend, which includes cybersecurity operations centers (CyberSOCs). Our research began with an extensive literature analysis to expand our insights derived from previous works, followed by a Spanish case study in collaboration with a digitization-focused public organization. The study revealed common features shared by public organizations globally. Collaborating with this public entity, we developed strategies tailored to its characteristics and transferrable to other public organizations. As a result, we propose the “Wide-Scope CyberSOC” as an innovative outsourced solution to enhance holistic awareness among the cross-functional cybersecurity team and facilitate comprehensive cybersecurity adoption within public organizations. We have also documented essential requirements for public entities when contracting Wide-Scope CyberSOC services to ensure alignment with their specific needs, accompanied by a management framework for seamless operation.

Teamwork in Cybersecurity: Evaluating the Cooperative Board Game [d0x3d!] as an Experimental Testbed

It is crucial to identify the knowledge, skills, and attitudes (KSAs) that contribute to success in cybersecurity teams. We introduce a board game, [d0x3d!], as an experimental testbed designed to create a controlled environment and set of manageable tasks aimed at exploring teamwork competencies that may be relevant to the cybersecurity workforce. [d0x3d!] requires players to work together and share information to retrieve stolen digital assets. The authors aim to improve the efficacy of cybersecurity team training by incorporating modern teamwork theory and measurement. This testbed provides a low-cost and user-friendly platform for training, evaluation, and research.

Compete to Learn: Toward Cybersecurity as a Sport

To support the workforce gap of skilled cybersecurity professionals, gamified pedagogical approaches for teaching cybersecurity have exponentially grown over the last two decades. During this same period, e-sports developed into a multi-billion dollar industry and became a staple on college campuses. In this work, we explore the opportunity to integrate e-sports and gamified cybersecurity approaches into the inaugural US Cyber Games Team. During this tenure, we learned many lessons about recruiting, assessing, and training cybersecurity teams. We share our approach, materials, and lessons learned to serve as a model for fielding amateur cybersecurity teams for future competition.

An Efficient Federated Learning System for Network Intrusion Detection

Network intrusion detection is used to detect unauthorized activities on a digital network, with which the cybersecurity teams of organizations can then kick-start prevention protocols to protect the security of their networks and data. In real-life scenarios, due to the lack of high-quality attack instance data, building an in-depth network intrusion detection system (NIDS) is always challenging for a single enterprise, in terms of handling complex network security threats. To remedy the problem, this article proposes an efficient intrusion detection system called dynamic weighted aggregation federated learning (DAFL) based on federated learning. Specifically, DAFL has used the full advantages of federated learning for data privacy preservation. Moreover, compared to a conventional federated-learning based intrusion detection system, our scheme has implemented dynamic filtering and weighting strategies for local models. In this way, DAFL can perform better in detecting network intrusions with less communication overhead. We give the detailed designs of DAFL, and our experimental results demonstrate that DAFL can achieve excellent detection performance with a low network communication overhead, with data privacy preserved.

186 Preventing and responding to a hack of a professional Facebook page

Krishona Martinson, Equine Extension Specialist at the University of Minnesota (UMN), established the UMN Extension Horse Facebook page in June 2010 to disseminate research-based information to horse owners and professionals. With Martinson as the owner, the page grew to over 25,000 followers and averaged an annual reach of 2.7 million people. In December 2022, hackers compromised Martinson's personal Facebook page, which was then disabled by Facebook, and gained ownership of the UMN Horse page. The goal of this abstract is to highlight the top 10 lessons learned, which can help others prevent and respond to a hack of a Facebook page. First, install 2-factor authentication. Martinson had not enabled this security feature because she was not comfortable sharing her contact information with Facebook. Second, use a passphrase instead of a password. Passphrases tend to be more difficult to crack due to their length. Third, delete unused social media accounts. The breach occurred when hackers connected Martinson's unused Instagram account to her personal Facebook page. Fourth, ensure the page has other administrators. Before the hackers removed all page administrators, the UMN quickly updated the page banner to notify followers of the hack, stopped all scheduled posts, and removed the branded profile photo to distance the UMN from any unwanted posts. Fifth, be aware of risks and have a plan. Martinson and the UMN page were likely targetssince she managed several Facebook pages and the UMN page had a sizable following. When planning, consider pulling metrics monthly and ensure content created specifically for Facebook (e.g., Live videos) is saved elsewhere so it is not lost if a hack occurs. Sixth, report the hack immediately to direct supervisors, your employers general counsel, and communications and cyber security teams. Seventh, change other account passwords that use the same email and the same or similar password. Eighth, as a precaution post-hack, remove page administrators who are also owners of other pages to reduce the risk of additional pages being hacked. Nineth, take screenshots of any unwanted posts or page changes. Proof of the hack is necessary when reporting to Facebook. Finally, complete as many Facebook forms as possible to report the hack. Martinson was able to file a trademark infringement report through Facebook but was unsuccessful in submitting other reports because her personal page was disabled. Despite efforts shared here, the UMN and Martinson's personal Facebook pages have yet to be recovered. We hope these tips will result in others being able to avoid a frustrating and disruptive Facebook hack or be more prepared when responding to one.

Artificial intelligence for cybersecurity: Literature review and future research directions

Artificial intelligence (AI) is a powerful technology that helps cybersecurity teams automate repetitive tasks, accelerate threat detection and response, and improve the accuracy of their actions to strengthen the security posture against various security issues and cyberattacks. This article presents a systematic literature review and a detailed analysis of AI use cases for cybersecurity provisioning. The review resulted in 2395 studies, of which 236 were identified as primary. This article classifies the identified AI use cases based on a NIST cybersecurity framework using a thematic analysis approach. This classification framework will provide readers with a comprehensive overview of the potential of AI to improve cybersecurity in different contexts. The review also identifies future research opportunities in emerging cybersecurity application areas, advanced AI methods, data representation, and the development of new infrastructures for the successful adoption of AI-based cybersecurity in today's era of digital transformation and polycrisis.

Automation of Quantifying Security Risk Level on Injection Attacks Based on Common Vulnerability Scoring System Metric

An injection attack is a cyber-attack that is one of The Open Web Application Security Project Top 10 Vulnerabilities. These attacks take advantage of insufficient user input validation into the system through the input surface of a Web application as that user in the browser. The company’s cyber security team must filter thousands of attacks to prioritize which attacks are considered the most dangerous to be mitigated first. This activity of filtering thousands of attacks takes much time because you have to check these attacks one by one. Therefore, a method is needed to assess how dangerous a cyber-attack is that enters an organization’s or company’s server. Injection attack detection can be done by analyzing the request data in the web server log. Our research attempts to perform quantification modeling of the variations of two types of injection attacks, SQL Injection (SQLi) and Cross-Site Scripting (XSS), using Common Vulnerability Scoring System Metrics (CVSS). CVSS metrics are generally used to calculate the level of dangerous weakness in the system. This metric is never used to calculate the level of how dangerous an attack is. The modeling that we have made shows that SQLi and XSS attacks have many variations in levels ranging from low to high levels. We discovered that when classified with Common Weakness Enumeration Database, SQLi and XSS attacks CVE values would have high-level congruence with almost 94% value between one another vector on CVSS.

Dangers of succumbing to bias in cyber security : An evaluation of the impact of cognitive biases on threat assessments and cyber security strategies

The greatest cyber threat to an organisation may be opposite to what its own security team assesses, a challenge that commonly arises from the impact of cognitive biases. At every turn, cognitive biases can distract and derail cyber security teams and their strategies away from the key risks and threats likely to catastrophically damage their network environments, in favour of new headline-making attack techniques or vulnerabilities which may never be used against their organisation. Focusing on psychological analysis within cyber security contexts including macro and micro examples from the international cyber community and Darktrace’s own customer base, this paper explores the dramatic impact cognitive biases can have on cyber security professionals, cyber strategies and decision making if left unchecked. Statistically, persistent, widely available, lower-sophistication malware and run-of-the-mill phishing campaigns remain a greater global risk to corporations than the newest, most devious exploit kit or ransomware. This paper examines multiple contextual examples of how cognitive biases negatively affect and influence cyber security teams from their security stack, the greatest threats to their networks and digital estates, understanding an attacker’s mindset and selecting technical experts to guide their programmes. Understanding these biases and identifying their role in cyber decision making is the only way to protect organisations from succumbing to biases and likely misdirecting already stretched security resources.

Secure Cloud Migration Strategy (SCMS): A Safe Journey to the Cloud

The state of cloud security is evolving. Many organizations are migrating their on-premises data centers to cloud networks at a rapid pace due to the benefits like cost-effectiveness, scalability, reliability, and flexibility. Yet, cloud environments also raise certain security concerns that may hinder their adoption. Cloud security threats may include data breaches/leaks, data loss, access management, insecure APIs, and misconfigured cloud storage. The security challenges associated with cloud computing have been widely studied in previous literature and different research groups. This paper conducted a systematic literature review and examined the research studies published between 2010 and 2023 within popular digital libraries. The paper then proposes a comprehensive Secure Cloud Migration Strategy (SCMS) that organizations can adopt to secure their cloud environment. The proposed SCMS consists of three main repeatable phases/processes, which are preparation; readiness and adoption; and testing. Among these phases, the author addresses tasks/projects from the different perspectives of the three cybersecurity teams, which are the blue team (defenders), the red team (attackers), and the yellow team (developers). This can be used by the Cloud Center of Excellence (CCoE) as a checklist that covers defending the cloud; attacking and abusing the cloud; and applying the security shift left concepts. In addition to that, the paper addresses the necessary cloud security documents/runbooks that should be developed and automated such as incident response runbook, disaster recovery planning, risk assessment methodology, and cloud security controls. Future research venues and open cloud security problems/issues were addressed throughout the paper. The ultimate goal is to support the development of a proper security system to an efficient cloud computing system to help harden organizations’ cloud infrastructures and increase the cloud security awareness level, which is significant to national security. Furthermore, practitioners and researchers can use the proposed solutions to replicate and/or extend the proposed work.

Indicators of employee phishing email behaviours: Intuition, elaboration, attention, and email typology

Employees’ behaviour to phishing emails can strengthen or undermine business organisations’ cyber security. This phishing simulation and survey study explored the relationship between sociodemographic, cyber security training, phishing email typology and information processing factors and risky and secure email response behaviours. Participants (N = 590) were employees of a large financial institution who received one of four types of phishing emails. Participants who engaged in risky cyber email behaviour clicked on the link in the phishing email whereas those who engaged in secure cyber email behaviour reported the email to the institutions cyber security team. Our findings show that the likelihood of clicking on a link in a phishing email was lower for participants who had greater faith in their intuition and paid more attention to the sender's email address. The likelihood of clicking on a link in a phishing email was greater for participants who received the ‘Undelivered package’ email relative to the ‘Received PDF’. The likelihood of reporting a phishing email was greater for participants who engaged in greater elaborative processing to evaluate the email than those who used less elaboration. Theoretical and practical implications as well as future directions are discussed.