Cybersecurity Governance Research Articles

Digitalisation and Cybersecurity: Towards an Operational Framework

As businesses increasingly adopt digital processes and solutions to enhance efficiency and productivity, they face heightened cybersecurity threats. Through a systematic literature review and concept development, this article examines the intersection of digitalisation and cybersecurity. It identifies the methodologies and tools used for cybersecurity assessments, factors influencing the adoption of cybersecurity measures, and the critical success factors for implementing these measures. The article also puts forward the concept of cybersecurity governance process categories, which are used to classify the factors uncovered in the research. Findings suggest that current information security standards tend to be too broad and not adequately tailored to the specific needs of small and medium-sized enterprises (SMEs) when implementing emerging technologies, like Internet of Things (IoT), blockchain, and artificial intelligence (AI). Additionally, these standards often employ a top-down approach, which makes it challenging for SMEs to effectively implement them, as they require more scalable solutions tailored to their specific risks and limited resources. The study thus proposes a new framework based on the Plan-Do-Check model, built around the cybersecurity governance process categories and the three core pillars of governance, culture and standards. This is essentially a bottom-up approach that complements current top-down methods, and will be of value to both information technology (IT) professionals as an operational guide, and to researchers as a basis for future research in this field.

Cybersecurity and Italian critical infrastructures: the return of the state?

ABSTRACT Security strategies have increasingly come to include references to critical infrastructures, seen as security assets to be preserved. In the Italian case, the rise in cyberattacks against critical infrastructures has been associated with a perception of their increasing relevance as potential threats. This has led to renewed attention towards the governance model adopted in this issue area and, in particular, towards the role of private actors and public-private partnerships, the actual owners of the infrastructures, now called upon to contribute to the provision of security as a public good, but with limited capabilities and a limited interest in doing so. Looking at the Italian case, the article shows that the traditional cybersecurity governance model, involving private actors in an equal relationship with public actors, has seen a subtle and gradual shift towards an increasing strengthening of the authority of public actors (verticalization).

Internet of Things, critical infrastructures, and the governance of cybersecurity in 5G network slicing

Over the last decade, cybersecurity has become a disruptive challenge driven by the shift to 5G networks. 5G is an application-agnostic general-purpose technology (GPT) characterized by its major role as multidimensional upstream technology for a large and open set of downstream Internet of Things (IoT) applications and use cases in various network industries and, more generally, within the economy as a whole. The focus of this paper is on the network economics of cybersecurity governance, considering the interplay between the recent EU cybersecurity regulatory framework, the extensive standardization efforts of international standardization organizations, and the economic incentives to tackle 5G network performance and security challenges. Based on the economic concept of 5G-based network slicing, the entrepreneurial challenges driven by the Internet of Things (IoT) are analyzed with an eye towards the complementarity between the physical side and virtual side of IoT applications. Network slicing gains particular relevance in the context of different types of logically separated, QoS-differentiated 5G bandwidth capacities, which are combined with other virtual resources such as sensor networks, data storage and processing, together with end-to-end slice security. It is shown in this paper that economic incentives for the implementation of 5G cybersecurity cannot be considered in isolation but must be viewed in combination with other performance requirements of 5G network slices. This is the driver for implementing network slicing architectures within 5G networks that feature a multitude of heterogeneous network slices with different QoS differentiation and various cybersecurity requirements.

Navigating Cybersecurity: Environment’s Impact on Standards Adoption and Board Involvement

ABSTRACT This study investigates cybersecurity governance dynamics within organizations, investigating the influence of supply chains, environmental factors, and stakeholder engagement. Utilizing the UK’s Cyber Security Longitudinal Survey and employing artificial neural networks and k-means cluster analysis, we explore how organizational practices and external pressures shape cybersecurity strategies. Our findings show the managerial and political dimensions of improving organizational cybersecurity, highlighting the critical role of environmental influences alongside incident perception and self-efficacy. The research shows the necessity for organizations to remain receptive to external influences and identifies supply chains as critical factor in shaping cybersecurity practices, advocating for comprehensive security protocols. We demonstrate that guidance from governing bodies is essential for aligning with industry standards. The findings suggest a range of strategies, from implementing standards to encouraging board-level integration of cybersecurity, facilitated by a combination of coercive, normative, and mimetic pressures exerted by various agents, including governments, stakeholders, and the supply chain.

The New F-word: The case of fragmentation in Dutch cybersecurity governance

The fragmentation of the Dutch cybersecurity government landscape is a widely discussed phenomenon among politicians, policy makers, and cybersecurity specialists. Remarkably though, a negative narrative is underlying the idea of fragmentation, suggesting that we are dealing with a serious problem. A problem that has the potential of impeding cybersecurity governance in the Netherlands. This research zooms in on how cybersecurity governance is organised within the central government, and which organisations are concerned with the creation, implementation, and oversight of cybersecurity policies vis à vis Dutch society. This article provides an overview of all central government organisations (de Rijksoverheid) that are involved in cybersecurity governance on a strategic level. This research provides the first step in doctoral research into the possible implications of the fragmentation of cybersecurity governance in the Dutch central government, and how this fragmentation could potentially impact policy creation, implementation, and oversight. Based on the mapping of this governance landscape, it set out to measure fragmentation based on the number of units or organisations that are concerned with cybersecurity governance in the central government on a strategic level. This study has found that based on Boyne's (1992) notion of fragmentation and the Dutch governments’ definition of tiers, the Dutch cybersecurity governance landscape could indeed, when meticulously following Boyne's counting procedure, be regarded as fragmented.

Enhancing digital access and inclusion for SMEs in the financial services industry through Cybersecurity GRC: A pathway to safer digital ecosystems

This research paper explores the enhancement of digital access and inclusion for Small and Medium Enterprises (SMEs) in the financial services industry by implementing Cybersecurity Governance, Risk Management, and Compliance (GRC) frameworks. It begins by analyzing the current state of digital access for SMEs, highlighting the significant benefits of digital transformation, including operational efficiencies, enhanced customer experiences, and new market opportunities. The paper identifies key barriers to digital access, such as cybersecurity risks, regulatory compliance challenges, financial constraints, and the lack of digital expertise. The study then reviews existing initiatives aimed at enhancing digital access for SMEs, including government programs, industry collaborations, cybersecurity awareness and training efforts, and fintech solutions. The paper argues that while these initiatives are beneficial, they often fail without a comprehensive GRC framework to address underlying security and compliance issues. A detailed conceptual model is proposed, comprising digital strategy and planning, a robust cybersecurity framework, effective governance and compliance practices, proactive risk management, continuous training and awareness, technological innovation, and collaboration and partnerships. Each component systematically addresses the identified barriers and facilitates a safer, more inclusive digital ecosystem for SMEs. The implementation of this model is outlined in four phases: initiation, implementation, operational, and evaluation, ensuring a structured approach to digital transformation. The paper concludes with recommendations for SMEs to adopt this model, emphasizing the importance of stakeholder engagement, resource allocation, and continuous evaluation. Keywords: Digital Transformation, SMEs, Cybersecurity, GRC, Financial Services, Digital Access.

When traditional SME managers encounter cybersecurity: Discourse analysis of opportunities and dilemmas in meeting the demands

Grounded in a socio-technical systems governance framework, we explore the perceptions and strategies of SME managers and cybersecurity providers within the cybersecurity landscape. Addressing the gap in understanding of how cybersecurity governance takes place in the Canadian SME landscape, Interviews were conducted with 35 SME representatives and 11 cybersecurity providers and analyzed using discourse analysis. The results highlight four critical themes in this socio-technical transition: initial conditions, SME business model discourse, cybersecurity provider business model discourse, and transition outcomes. The transition underpins a mode of governance, blending elements of oligopoly and self-regulation, characterized by the dominance of key cybersecurity firms and a more facilitative role of state actors. A novel conceptual model emerges from the study, explicating the transition in SME institutional logics from a traditional ‘legacy logic’ towards an integrated cybersecurity approach. This transition is shaped by the principal-agent disconnect and moderated by SME and cybersecurity provider business model discourses.

Impact of Cybersecurity Regulations on Corporate Compliance Practices in Japan

Purpose: The aim of the study was to analyze impact of cybersecurity regulations on corporate compliance practices in Japan. Methodology: This study adopted a desk methodology. A desk study research design is commonly known as secondary data collection. This is basically collecting data from existing resources preferably because of its low cost advantage as compared to a field research. Our current study looked into already published studies and reports as the data was easily accessed through online journals and libraries. Findings: In Japan, cybersecurity regulations have significantly influenced corporate compliance practices. The Act on the Prohibition of Unauthorized Computer Access, along with the Penal Code, outlines stringent measures against cybercrimes, mandating corporations to adopt robust cybersecurity protocols to protect against unauthorized access and data breaches. Furthermore, comprehensive data protection laws, such as the Act on the Protection of Personal Information (APPI), require companies to obtain explicit consent for data processing, ensuring a higher standard of data privacy and security compliance. Unique Contribution to Theory, Practice and Policy: Institutional theory, resource dependence theory & contingency theory may be used to anchor future studies on cybersecurity regulations on corporate compliance practices. Organizations should prioritize building a robust cybersecurity governance framework that integrates regulatory compliance requirements into broader risk management strategies. Policymakers and regulators should adopt a risk-based approach to cybersecurity regulation that takes into account the diverse needs and capabilities of organizations across different sectors and geographical regions.

From COBIT to ISO 42001: Evaluating cybersecurity frameworks for opportunities, risks, and regulatory compliance in commercializing large language models

This study investigated the integration readiness of four predominant cybersecurity Governance, Risk and Compliance (GRC) frameworks – NIST CSF 2.0, COBIT 2019, ISO 27001:2022, and the latest ISO 42001:2023 – for the opportunities, risks, and regulatory compliance when adopting Large Language Models (LLMs), using qualitative content analysis and expert validation. Our analysis, with both LLMs and human experts in the loop, uncovered potential for LLM integration together with inadequacies in LLM risk oversight of those frameworks. Comparative gap analysis has highlighted that the new ISO 42001:2023, specifically designed for Artificial Intelligence (AI) management systems, provided most comprehensive facilitation for LLM opportunities, whereas COBIT 2019 aligned most closely with the European Union AI Act. Nonetheless, our findings suggested that all evaluated frameworks would benefit from enhancements to more effectively and more comprehensively address the multifaceted risks associated with LLMs, indicating a critical and time-sensitive need for their continuous evolution. We propose integrating human-expert-in-the-loop validation processes as crucial for enhancing cybersecurity frameworks to support secure and compliant LLM integration, and discuss implications for the continuous evolution of cybersecurity GRC frameworks to support the secure integration of LLMs.

The Importance of Cybersecurity Governance Model in Operational Technology Environments

There is a common will to unify regulation in the Western world regarding overall security, including cybersecurity. European cyber security regulations aim to create a foundation and guidelines for international standards in various industries and the operation of critical infrastructure. Protected critical infrastructure is a common goal for Western allies. Allies of NATO and EU member states mainly support the anti-aggression policy in Europe. The unstable situation in the world forces states to find solutions that represent the thoughts of the allies. Defending common values is crucial when the purpose is to protect critical infrastructure and vital functions in societies. The research will demonstrate the industrial needs of IT/OT-related cybersecurity governance. The study analyzes EU-level cybersecurity requirements and how those requirements affect standardization regarding cybersecurity governance in the operational technology environment. There will be four primary governance levels: Political, Strategical, Operational and Tactical. Many criminal state-linked operators do not care about international agreements or contracts. Some rogue states have even taken to inciting violations of international agreements. We cannot trust the loose contracts between states anymore. The research will find the main challenges concerning the cybersecurity governance of the industrial organizations that use operational technology-related technology in their daily businesses. We have seen that Information and Operational Technology are based on something other than similar threats and risk basements. Operational Technology-related threats threaten the cyber-physical ecosystem where anomalies affect the physical world, so operational functions of equipment, devices, sensors, components, and production lines are interrupted. As a result, continuity management and supply chain management are compromised. The study's primary purpose is to describe the cybersecurity governance elements of the OT environment for enhancing situational awareness. Standardizing the cybersecurity level among industrial stakeholders requires EU member states to have a national cybersecurity strategy that follows main EU-level guidelines. Despite the EU member states' implementation level of the regulation, the EU-level cybersecurity requirements obligate companies to take steps to solve future cybersecurity challenges.

The Impact of Operational Technology Requirements in Maritime Industries

The maritime ecosystem and industry require more efficient and coordinated cybersecurity governance. No common cybersecurity mechanism in the maritime sector may steer the whole supply chain management, for example, in the port areas and fairways. Cyberthreat prevention mechanisms in harbor areas and port terminals must be standardized more in the Western world. It has been recognized that understanding cybersecurity of operational technology in the harbor area is based on a more traditional experience of what it requires. The overall security of the maritime ecosystem requires more than random checks of passengers and vehicles and customs functions on cargo and passenger transportation, which are mainly physical security service routines. Traditional physical threats have changed to a combination of threat types. Hybrid threats may prevent everyday harbor activities so that damage can become long-lasting and harm overall business continuity management. It is crucial to prevent cyber threat factors in the maritime domain. The research provides transnational and EU-level cyber security assessments regarding cyber security regulation. The findings determine where to direct and concentrate a focus maritime domain and why it is essential to survey cyber security requirements set for member states to apply. In Finland, this research belongs to the cybersecurity governance of operational technology in the sector connected to the smart energy networks (CSG) research program. The project aims to develop a common cybersecurity governance model for operational technology.

Opening up or closing down? Non-state actors in UN cybersecurity governance

Abstract How can we explain the varying participation of non-state actors in UN cybersecurity governance? While research often underlines the importance of non-state actors in governing cybersecurity, research on international non-state actors’ activities also shows that shrinking spaces reduce opportunities for these actors. So far, we do not know how these two seemingly opposing developments impact UN cybersecurity governance. In this article, we analyze how state interests, ideas on representation, and institutional context affect non-state actor participation in three UN forums for cybersecurity, namely the IGF, OEWG, and AHC. Based on qualitative data and a quantitative participation analysis, we find that institutional mandates of forums remain open to non-state actors but to varying degrees. Conflicts among states affect non-state actors strongly, but often indirectly, because their participation becomes politicized, and states increasingly contest ideas on their participation. These effects concern all groups of non-state actors. All in all, our results suggest that UN cybersecurity governance is still open to non-state actors, but despite functional arguments, their participation is facing growing resistance over time. At the same time, reasons why non-state actors choose to participate or not require more consideration.

Advancing coordination in critical maritime infrastructure protection: Lessons from maritime piracy and cybersecurity

Critical maritime infrastructure protection has become a priority in ocean governance, particularly in Europe. Increased geopolitical tensions, regional conflicts, and the Nord Stream pipeline attacks in the Baltic Sea of September 2022 have been the main catalysts for this development. Calls for enhancing critical maritime infrastructure protection have multiplied, yet, what this implies in practice is less clear. This is partially a question of engineering and risk analysis. It also concerns how the multitude of actors involved can act concertedly. Dialogue, information sharing, and coordination are required, but there is a lack of discussion about which institutional set ups would lend themselves. In this article, we argue that the maritime counter-piracy operations off Somalia, as well as maritime cybersecurity governance hold valuable lessons to provide new answers for the institutional question in the critical maritime infrastructure protection agenda. We start by clarifying what is at stake in the CMIP agenda and why it is a major contemporary governance challenge. We then examine and assess the instruments found in maritime counter-piracy and maritime cybersecurity governance, including why and how they provide effective solutions for enhancing critical maritime infrastructure protection. Finally, we assess the ongoing institution building for CMIP in Europe. While we focus on the European experience, our discussion on designing institutions carries forward lessons for CMIP in other regions, too.

Cybersecurity governance and digital finance: Evidence from sovereign states

Digital finance provides unprecedented development opportunities for countries, especially in times of epidemic, and digital transformation has become an important means of accelerating economic development and maintaining social stability. However, digital finance relies on Internet infrastructure, and cybersecurity challenges have increased, bringing severe security risks to digital finance. Therefore, safeguarding network security has become a key cornerstone for the development of digital finance. This paper analyzes and explores the main cybersecurity problems faced in the era of big data from the perspective of the current development status of digital finance, and at the same time shows some new initiatives currently underway in the international arena in order to meet the challenges posed by cybersecurity and to help navigate the sustainable development of global digital finance.

Monocratic cybersecurity in the EU member states: insights from Italy, France, Germany and Spain

ABSTRACT The paper investigates the interplay between the development of cybersecurity policies and one of the major transformations underway in contemporary democratic regimes, i.e. the gradual shifting of power and decision-making authority from parliamentary assemblies towards national governments and prime ministers. The study relates the structure of cybersecurity governance in the four major EU member states (i.e. France, Germany, Italy and Spain) to the rise of the monocratic government, meant as a political process affecting the relationships both between executive and legislative powers, and between public authorities and private interests. The analysis shows how monocratization affects national cybersecurity policies in contemporary Western democracies, albeit to varying degrees in the four Eu member states. Furthermore, the analysis emphasizes the role of cybersecurity policymaking as a driver of monocratization, which is gradually expanding the power of prime ministers at the expense of parliaments.

Navigating Cybersecurity Governance: The influence of opportunity structures in socio-technical transitions for small and medium enterprises

This study examines cybersecurity discourses of small and medium size businesses in Canada. The findings culminated in a novel conceptual framework, which captures the intricate interplay between the discourse of agency, prevailing conditions, and the resultant discourse of strategy. Central to this model is the discourse of agency, framing cybersecurity as either a high agency mechanism actively contributing to business objectives, or a low agency mechanism perceived as a passive burden. The conditions under which businesses operate, characterized by external pressures and internal motivations, alongside the degree of environmental support, further shape their cybersecurity narratives. These dynamics significantly influence the resultant discourse of strategy, leading to four distinct strategic narratives: Synergistic Asset, Operational Pragmatism, Ambivalent Prospect, and Impractical Liability. For instance, a discourse of Synergistic Asset reflects a perception of an environment positively influenced by robust governmental cybersecurity initiatives, setting benchmarks in cybersecurity practices. Conversely, a discourse of Impractical Liability reflects pronounced levels of risk, influenced by societal narratives and economic apprehensions. We offer a comprehensive model for understanding cybersecurity discourses, bridging empirical findings with theoretical underpinnings, and providing valuable insights for both academia and industry.

What is the future of Brazil’s cybersecurity governance?

What is the future of Brazil’s cybersecurity governance?

Perceptions and dilemmas around cyber-security in a Spanish research center after a cyber-attack

Information and Communication Technologies and Internet networks are present in all aspects of social reality and are essential elements in research, development and innovation centers (R&D&I). Cyber-security is crucial for the progress of the research activities developed in these centers, especially given the exponential growth of cyber-attacks and incidents. The present study aims to assess from a socio-technical approach, how a serious cyber-attack on a Spanish research center has affected staff’s perceptions of information and communication systems (ICT) security. This study employed a mixed-methods research strategy, combining quantitative and qualitative methods to provide a comprehensive and nuanced understanding of ICT security perceptions among employees. First a quantitative scale was administered to 1,321 employees 3 years before the cyber-attack and 4 months afterward, to measure ICT security perceptions. Then, qualitative techniques (semi-structured interviews, focus groups, and micro-ethnography) were applied to gain a deeper understanding of the arguments underpinning cyber-security at the center after the attack. The results show that the event had an impact on employees’ perceptions, increasing the perceived importance of ICT security, with positive behavioral changes noted, but with doubts about their sustainability over time. Also, the need for cyber-security governance was critically contrasted with organizational reality. Finally, the compatibility of science and cyber-security was a central dilemma, which seems to confront antagonistic poles (research and security ICT) and justify the non-compliance with security protocols by part of the staff.

Carlos Solar, Cybersecurity Governance in Latin America: States, Threats, and Alliances State University of New York Press, 2023, pp. 352

Carlos Solar, Cybersecurity Governance in Latin America: States, Threats, and Alliances State University of New York Press, 2023, pp. 352

Cybersecurity Governance: Managing Risk in Tertiary Institutions

Cybersecurity Governance: Managing Risk in Tertiary Institutions