Cybersecurity Policy Research Articles

‘What a waste of time’: An examination of cybersecurity legitimacy

AbstractManagers who oversee cybersecurity policies commonly rely on managerial encouragement (e.g., rewards) and employee characteristics (e.g., attitude) to drive compliant behaviour. However, whereas some cybersecurity initiatives are perceived as reasonable by employees, others are viewed as a ‘waste of time’. This research introduces employee judgements of cybersecurity legitimacy as a new angle for understanding employee compliance with cybersecurity policies over time. Drawing on theory from the organisational legitimacy and cybersecurity literature, we conduct a three‐wave survey of 529 employees and find that, for each separate wave, negative legitimacy judgements mediate the relationship between management support and compliance, as well as between cybersecurity inconvenience and compliance. Our results provide support for cybersecurity legitimacy as an important influence on employee compliance with cybersecurity initiatives. This is significant because it highlights to managers the importance of not simply expecting compliant employee behaviour to follow from the introduction of cybersecurity initiatives, but that employees need to be convinced that the initiatives are fair and reasonable. Interestingly, we did not find sufficient support for our expectation that the increased likelihood of a cybersecurity incident will moderate the legitimacy‐policy compliance relationship. This result suggests that the legitimacy perceptions of employees are unyielding to differences in the risk characteristics of the cybersecurity incidents facing organisations.

Current status and perspectives of personal data protection under the conditions of marital state

The aggression of russia has created numerous problems in terms of legal and organizational protection of personal data. Therefore, this article analyzes the current state and prospects of personal data protection during a state of war. The author examines the changes to legislation in this field caused by russia’s full-scale invasion and analyzes the state of cybersecurity legislation in Ukraine as part of personal data protection.Emphasis is placed on the fact that effective protection of personal data is impossible without ensuring cybersecurity. The experience of Estonia as a leading European country in this field is highlighted. The main directions of Estonia’s data protection policy are indicated.The analysis of legislation and law enforcement practices highlights a number of issues, such as the absence of a plan for cyber attacks and the vulnerability of devices used for photo and video documentation at checkpoints. It is expressed that these shortcomings need to be addressed through the adoption of a new law on personal data protection.Regarding the prospects of personal data protection in a state of war, the article argues that measures for safeguarding personal data should be taken by both private individuals and state institutions. Private individuals should employ measures such as using reliable software and data encryption. State institutions should implement the following measures: in the event of a threat of occupation of a specific locality, the authorities and their officials should destroy documents and other physical media containing personal data of Ukrainian citizens.The overall conclusion is that the protection of personal data is a constant challenge, and the development of new technologies requires continual updating of security measures. Users and organizations must be knowledgeable and cautious in the processing and transmission of personal data, while legislation and standards need to constantly adapt to changes in the digital environment and the military-political sphere.

Human-Centric Cybersecurity: Understanding and Mitigating the Role of Human Error in Cyber Incidents

In this study, developments in cybersecurity continue to be treated as human deficiencies, such as the territory of policies, procedures and misconduct, mainly cultivating the floods of organizations. The important role of human factors in vulnerability To address this issue of negligence, the study presents a human-centered cybersecurity program that includes ongoing user training of the system, behavioral monitoring, and proposals including detection tools enhanced by AI. The research objectives are twofold: first, to examine how human actions contribute to cyber vulnerabilities, and second, to identify effective ways to mitigate these risks through user-centered approaches integration of roles found that the results show that human-centered policies significantly improve cybersecurity outcomes. Phishing error rates dropped from 15-20% to 5-10%, and password misuse dropped from 30-40% to 10-15%. The system reduced incident response time from 48-72 hours to even 24-36 hours, while increasing user engagement in safety actions. Additionally, the overall cost of a security breach is halved. This study emphasizes the need to address human behavior alongside technological processes to develop flexible and comprehensive cybersecurity policies.

Cyber security laws and safety in e-commerce in India

In today’s information technology age, the issue of cyber Security is a complicated and fascinating area of law. The phenomenal growth and development of e-commerce in India is astounding. However, with the rising dependence on internet commerce, the dangers of fraud and security and trust problems have become severe impediments. Creating robust legal and regulatory frameworks that meet the growing concerns about online fraud, data security, and intellectual property protection in both local and international business contexts is critical. The e-commerce sector, like any expanding business, confronts various obstacles, primarily due to an inadequate and inefficient legal and regulatory framework that fails to guarantee the rights and duties of all players engaged sufficiently. To protect user data, tackle cyber threats, and maintain customer trust, e-commerce enterprises must comply with legal regulations. In India, cybersecurity governance falls under the Information Technology Act of 2000, regulating e-commerce, electronic contracts, data protection, and cybercrimes. The imminent passage of the Personal Data Protection Bill, 2019, is expected after ongoing review. The Indian Penal Code addresses unauthorized access, hacking, identity theft, phishing, and computer virus dissemination. The Reserve Bank of India oversees online payment and financial security, mandating two-factor authentication, encryption, and secure payment channels. CERT-In coordinates national cybersecurity incidents, while electronic signatures and digital certificates hold legal recognition. Intellectual Property Laws regulate online violations of patents, copyrights, and trademarks. The Indian government also enforces cybersecurity standards for enterprises and organizations, covering IT infrastructure and incident response. Nonetheless, further steps must be taken to improve the efficiency of India’s cyber security regulations. This research study uses a doctrinal and analytical approach to examine India’s present Cyber Security Laws and Guidelines. It assesses their effectiveness in addressing legal concerns with Security, privacy, and data protection inside the country. It also evaluates the legal structure that governs the link between e-commerce and Cyber Laws in India. This research will provide a thorough overview of the present condition of cyber security regulations in India, setting the way for prospective reforms and progress in this critical area.

Exploring the Relationship Between Cybersecurity Culture and Cyber-Crime Prevention: A Systematic Review

Cybercrime requires a multidimensional approach addressing technical, organisational, and human factors to prevent cyber-attacks. This systematic review highlights the significance of a strong cybersecurity culture in mitigating the risks of cyberattacks and enhancing an organisation's resilience. Implementing training and awareness programmes, establishing leadership support and accountability mechanisms, and fostering employee engagement are strategies for promoting a strong cybersecurity culture. However, fostering a robust culture of cybersecurity can be challenging and requires the participation of various stakeholders. Training and awareness programmes can significantly improve employee cybersecurity knowledge and behaviour, and leadership support is essential for establishing a cybersecurity culture. It is possible to enforce employee compliance with cybersecurity policies and procedures through accountability mechanisms, such as consequences for noncompliance and periodic security audits. Involving employees in the creation of cybersecurity policies and procedures, as well as recognising and rewarding responsible behaviour, can increase employee engagement and investment in cybersecurity. Although technical measures such as firewalls and encryption are essential for defending against cyber-attacks, a strong cybersecurity culture is necessary to mitigate cybercrime risks and enhance an organisation's resilience. Future research should identify and evaluate effective strategies for cultivating a robust cybersecurity culture in the context of preventing cybercrime. Cybersecurity should be a top priority for businesses and individuals, who must take preventative measures against cyber-attacks. By fostering a robust culture of cybersecurity, businesses can increase their resilience and reduce the risks of cybercrime.

Media presentations of Vietnam's cybersecurity law: A comparative approach with corpus-based critical discourse analysis

The study uses corpus-based critical discourse analysis to examine the divergent framing and positioning of cybersecurity issues and Vietnam's Cybersecurity Law by state-sponsored media and international media through topic modeling, bigram and trigram collocation, and concordance analyses. The findings reveal that Vietnam's national media tend to justify the law by emphasizing human-related cyber threats, legitimizing national security, and delegitimizing opposing forces. In contrast, international media outlets focus on providing critical comments, criticism, and real-life events of human rights violations in the country to question and confront the law's legitimacy. The study also analyzes the competitive and tense nature of the discourses, characterized by antagonistic responses between the two media sources.

Cybersecurity and Geopolitics in the Dominican Republic: Threats, Policies and Future Prospects

Cybersecurity, an increasingly pertinent topic in today's globalized world, is the central focus of this paper, which provides a comprehensive guide to the cybersecurity landscape in the Dominican Republic. The authors delve into the country's cyber threats and vulnerabilities, its current cybersecurity policy, the interplay between cybersecurity and national security, and the role of diplomacy in addressing cybersecurity issues. The paper also presents real-world examples of cyberattacks and cybersecurity responses in the Dominican Republic, and discusses future prospects for cybersecurity in the country. Cyberattacks pose a constant threat to national security, economies, and critical infrastructure worldwide. As these issues transcend national borders, international collaboration becomes critical in confronting these threats and safeguarding global citizens and institutions. This paper aims to not only shed light on the specific case of the Dominican Republic but also serve as a reference for other contexts. The methodology, results, and conclusions drawn from the analyzed texts will be detailed in the subsequent sections of the paper.

Role of Techno-Economic Coalitions in Future Cyberspace Governance: 'Backcasting' as a Method for Strategic Foresight

In an increasingly complex threat landscape, many nations struggle with developing and implementing effective cybersecurity policies for cyberspace governance at a national and international level. Balancing between the demands for establishing national sovereignty and strengthening international collaboration in cyberspace have become a problematic assignment. Collaborating with nations supporting extensively dissimilar ideologies and cybersecurity policies is controversial. Yet, it is almost impossible for a single country to achieve 'self-sufficiency' in cyberspace. Thus, in order to remain competitive, protected, and resilient one must either join or strengthen a developing techno-economic coalition with similar national cybersecurity policies and/or ideological framework. Consequently, this paper argues that techno-economic coalitions serve as an emerging issue or trend for strategic foresight in cyberspace governance in the future. This paper discusses the potential formation of techno-economic coalitions and shows how 'backcasting' can be used in strategic foresight. In this paper, 'backcasting' is not used as a method for creating a traditional strategic map to a future goal, but as a framework for determining what should have happened in order for the techno-economic coalitions to emerge in future cyberspace, i.e. for finding issues or trends that should be followed in strategic foresight today. Firstly, cyberspace governance in relation to national cybersecurity policies is contextualised. Secondly, the concept of techno-economic coalition is defined and the potential emerging techno-economic coalitions are explicated. Thirdly, 'backcasting' as a method for strategic foresight is described. Fourthly, the results of a 'backcasting' experiment in a strategic foresight workshop are presented. And finally, the future formation and role of techno-economic coalitions in cyberspace governance and in cyber defence both at a national and international level are discussed. The role of techno-economic coalitions in future cyberspace governance should be understood and considered today when developing strategic plans and implementing national and international cybersecurity policies.

Legal Response to Social Media Disinformation on National Level

Social media has an enormous impact on the manner in which society communicates and shares information. Digital is no longer a supplementary channel, but is the first place most people go to for news, information and communication. The transmission of social media disinformation has increased dramatically across the world and it necessitates a response. The discussion focuses on the response to social media disinformation on a national level. The discussion does not focus on foreign state or state-sponsored actors of misinformation. The focus and publicity may - within the context of cybersecurity - predominantly have been on cyberattacks, such as ransomware attacks. However, recent incidents - unrelated to foreign state interference and cyberattacks - illustrate that cybersecurity law must encompass the threat of disinformation. The 2020 COVID-19 pandemic, 2021 Washington, DC, United States, and South African as well as the 2023 Brazil riots illustrate the harmfulness of social media disinformation. Cognisance should be taken of the lessons learnt from the examples of social media disinformation as it may assist in determining a response to disinformation. There are various responses to national social media disinformation, such as legislative social media platform regulation, censorship, and criminalisation of the disinformation by itself. The response within the context of a cybersecurity threat landscape necessitates scrutiny as the response may impact on human rights. The trade-off between security and human right protection may be the violation of human rights to prevent harm from disinformation.

Human Error - A Critical Contributing Factor to the Rise in Data Breaches: A Case Study of Higher Education

Abstract With increasing technical safeguards to protect information systems, Human error continues to be a critical factor contributing to the rise in information systems attacks and data breaches. Inadequate or unenforceable Cybersecurity policies or training can open doors for adversaries to circumvent technical safeguards and paint a picture of a growing cybersecurity problem. The problem investigated in this work assesses if organizations adequately invest in resources to provide industry-aligned cybersecurity education, training, and awareness that can minimize human error leading to cyber-attacks. This work aims to investigate breaches attributed to human errors and compare cybersecurity policies, education, training, and awareness programs in three different schools in New York State. The work focused on user awareness and vulnerable behaviours, effective training for users, and investigating start-of-the-art approaches to gauge or evaluate the organization’s cybersecurity stance when compared to industry frameworks like the NIST framework. A Triangulation research approach including quantitative, qualitative, and descriptive methods are adopted for this work. Instruments for data collection include a survey, literature review, qualitative analysis to identify research gaps, and assessments of the questionnaires. This work demonstrates that formulated enforced cybersecurity policies coupled with targeted security education, training, and awareness are instrumental to decreasing user errors, thereby reducing the probability of a cyber-attack.

The impacts of the cyber-trust program on the cybersecurity maturity of government entities in the Kingdom of Bahrain

PurposeThis study aims to determine the impacts of the Bahrain Government framework [cyber-trust program (CTP)] on the cybersecurity maturity of government entities and how the CTP can impact the cybersecurity of government entities in the Kingdom of Bahrain.Design/methodology/approachThe authors used a quantitative and qualitative approach. The data were collected by conducting semi-structured interviews with the information technology experts in the Bahrain Government entities participating in the CTP. Also, quantitative data was obtained through a questionnaire distributed to relevant people in the information technology field.FindingsThe findings of this study suggest that the CTP had a significant impact on the cybersecurity assurance of the government entities that participated in the CTP; it increased the employees’ awareness, reduced the number of cyberattacks and optimized the available resources. The findings also highlighted the role of top management in the success of the implementation of the CTP. The results also ensure that the CTP’s maturity model affected the cybersecurity compliance of an organization and the implementation of cybersecurity policies and controls.Practical implicationsThis study enhances cybersecurity researchers’ and practitioners’ understanding of the impact of the CTP and its components and evaluates its influence on Bahrain’s cybersecurity assurance.Originality/valueThis study implies that to achieve better cybersecurity, managers should focus on implementing the policies and controls provided by cybersecurity frameworks to enhance cybersecurity assurance.

Risk-Based Cybersecurity Compliance Assessment System (RC2AS)

Cybersecurity attacks are still causing significant threats to individuals and organizations, affecting almost all aspects of life. Therefore, many countries worldwide try to overcome this by introducing and applying cybersecurity regularity frameworks to maintain organizations’ information and digital resources. Saudi Arabia has taken practical steps in this direction by developing the essential cybersecurity control (ECC) as a national cybersecurity regulation reference. Generally, the compliance assessment processes of different international cybersecurity standards and controls (ISO2700x, PCI, and NIST) are generic for all organizations with different scopes, business functionality, and criticality level, where the overall compliance score is absent with no consideration of the security control risk. Therefore, to address all of these shortcomings, this research takes the ECC as a baseline to build a comprehensive and customized risk-based cybersecurity compliance assessment system (RC2AS). ECC has been chosen because it is well-defined and inspired by many international standards. Another motive for this choice is the limited related works that have deeply studied ECC. RC2AS is developed to be compatible with the current ECC tool. It offers an offline self-assessment tool that helps the organization expedite the assessment process, identify current weaknesses, and provide better planning to enhance its level based on its priorities. Additionally, RC2AS proposes four methods to calculate the overall compliance score with ECC. Several scenarios are conducted to assess these methods and compare their performance. The goal is to reflect the accurate compliance score of an organization while considering its domain, needs, resources, and risk level of its security controls. Finally, the outputs of the assessment process are displayed through rich dashboards that comprehensively present the organization’s cybersecurity maturity and suggest an improvement plan for its level of compliance.

Cybersecurity for Heat Treaters

Abstract This article describes recent U.S. government cybersecurity regulations and their applicability to the heat treating industry. Compliance mitigates the impact of lost or compromised data, secures sensitive information, helps maintain a trustworthy reputation with customers, and helps to avoid the ensuing legal trouble that comes after a cybersecurity breach.

Legal challenges in ensuring the cybersecurity of genetic data in the Russian Federation

The article explores problematic issues of legal regulation of genetic data cybersecurity. The author points out gaps in the legal framework regulating the requirements for collection, storage, processing and transfer of genetic data as a special type of personal data. The author investigates the aspects of insufficient protection of genetic information and the main reasons and sources of threats for private and public interests. The author proposed ways to improve the legislation in order to counteract cyber risks in conditions of a significant growth of genetic data in the Internet space, in particular, to approve mandatory security requirements when dealing with genetic information, to increase responsibility for violation of legislation in the field of personal data, to limit the range of persons having access to genetic databases and other mechanisms of legal regulation.

Remote vigilance: The roles of cyber awareness and cybersecurity policies among remote workers

The convergence of increased remote working and rising cybersecurity threats have created a severe challenge for organizations. As firms continue to embrace remote working, the challenges of cybersecurity threats and risks remain unresolved. This study draws upon the Peltzman Effect and the complacency framework to explore how remote working may trigger a moral hazard regarding employee cybersecurity awareness and security-based precaution-taking.Data collected from 203 remote workers across the US provide strong support for the research model. Contrary to widely held beliefs about remote working, the results indicate that remote working is positively associated with cybersecurity awareness and security-based precaution-taking. The findings further show that information security policy compliance moderates the effect of remote working on cybersecurity awareness. In addition, the study reveals that as remote workers gain cybersecurity awareness, they are more likely to apply security-based precaution measures. The study complements current theoretical frameworks on security-precaution behaviors and provides insights to managers grappling with remote working in the face of burgeoning cybersecurity threats.

A Comparative Study of Cybersecurity Laws in India and Other Countries

Cybersecurity laws are essential in protecting individuals and organization from cyber threats, but they can very significantly from country to country. In this comparative study, we examine the cybersecurity laws in India and other countries, including Japan, Germany and Australia. We compare and contrast the legal framework of each country, focusing on areas such as data privacy, cybersecurity incident reporting, and regulatory enforcement. Thought this analysis, we aim to identify the strength and weakness of each country‟s cybersecurity laws and provide insights into how India could improve its legal framework. This research will be useful for policymakers, legal professionals, and cybersecurity experts who are interested in understanding the global landscape of cybersecurity laws and hoe they can be applied in the Indian context.

Cybersecurity Awareness Assessment among Trainees of the Technical and Vocational Training Corporation

People are the weakest link in the cybersecurity chain when viewed in the context of technological advancement. People become vulnerable to trickery through contemporary technical developments such as social media platforms. Information accessibility and flow have increased rapidly and effectively; however, due to this increase, new electronic risks, or so-called cybercrime, such as phishing, scams, and hacking, lead to privacy breaches and hardware sabotage. Therefore, ensuring data privacy is vital, particularly in an educational institute where students constitute the large majority of users. Students or trainees violate cybersecurity policies due to their lack of awareness about the cybersecurity environment and the consequences of cybercrime. This paper aims to assess the level of awareness of cybersecurity, users’ activities, and user responses to cybersecurity issues. This paper collected data based on a distributed questionnaire among trainees in the Technical and Vocational Training Corporation (TVTC) to demonstrate the necessity of increasing user awareness and training. In this study, quantitative research techniques were utilized to analyze the responses from trainees using tests such as the Chi-Squared test. Proof of the reliability of the survey was provided using Cronbach’s alpha test. This research identifies the deficiencies in cybersecurity awareness among TVTC trainees. After analyzing the gathered data, recommendations for tackling these shortcomings were offered, with the aim of enhancing trainees’ decision-making skills regarding privacy and security using the Nudge model.

Modelling cybersecurity regulations for automated vehicles

Technological advancements in Connected and Automated Vehicles (CAVs), particularly the integration of diverse stakeholder groups (communication service providers, road operators, automakers, repairers, CAV consumers, and the general public) and the pursuit of new economic opportunities, have resulted in the emergence of new technical, legal, and social challenges. The most pressing challenge is deterring criminal behaviour in both the physical and cyber realms through the adoption of CAV cybersecurity protocols and regulations. However, the literature lacks a systematic decision tool to analyze the impact of the potential cybersecurity regulations for dynamically interacting stakeholders, and to identify the leverage points to minimise the cyber-risks. To address this knowledge gap, this study uses systems theory to develop a dynamic modelling tool to analyze the indirect consequences of potential CAVs cybersecurity regulations in the medium to long term.It is hypothesized that CAVs Cybersecurity Regulatory Framework (CRF) is the property of the entire ITS stakeholders. The CRF is modelled using the System Dynamic based Stock-and-Flow-Model (SFM) technique. The SFM is founded on five critical pillars: the Cybersecurity Policy Stack, the Hacker's Capability, Logfiles, CAV Adopters, and intelligence-assisted traffic police. It is found that decision-makers should focus on three major leverage points: establishing a CRF grounded on automakers' innovation; sharing risks in eliminating negative externalities associated with underinvestment and knowledge asymmetries in cybersecurity; and capitalising on massive CAV-generated data in CAV operations. The formal integration of intelligence analysts and computer crime investigators to strengthen traffic police capabilities is pivotal. Recommendations for automakers include data-profiteering in CAV design, production, sales, marketing, safety enhancements and enabling consumer data transparency.Furthermore, CAVs-CRF necessitate a balanced approach to the trade-off between: i) data accessibility constraints on CAV automakers and ITS service providers; ii) regulator command and control thresholds; iii) automakers' business investment protection; and iv) consumers' data privacy guard.

Cybersecurity Policy of Modern Education

The subject of the study is the activity of law enforcement agencies in the fight against cybercrime. The object of the study is the social relations that arise in the field of education during the implementation of the program to combat cybercrime in Russia. The author examines the issues of crimes committed with the help of information technologies or in cyberspace, as well as the organization of counteraction to their commission, activities aimed at protecting the health of citizens, ensuring state and public security. Studies the process of using modern methods in the identification and disclosure of crimes committed using information and telecommunication technologies. Special attention is paid to the strategy of digital transformation of education of schoolchildren and students: according to which students will be able to master the knowledge necessary to protect themselves and their data when working with technical means of communication. The novelty lies in the fact that the way being worked out to solve the problem of growing crime in the information environment and crime using modern technologies directly affects the modern educational processes of schoolchildren and students, who in the future should become a bulwark of protecting the population from cybercrime. The main conclusion of the study is that such an improvement in education will increase the general digital literacy of the population, the level of public confidence in the state, and in particular in law enforcement agencies. It will provide a fast, comprehensive search for malicious sites, in view of which their number, as well as the negative effect of such, will decrease, which will lead to a decrease in cybercrime in Russia.

A COMPARATIVE ANALYSIS OF THE IMPACT OF SOCIAL NETWORKING SITES AND THE RELATING STATUTES

The Internet is a massive computer complex that has caused millions of deaths and served both as a force of protection and destruction. As all coins have two faces, another hand of Internet is that it had overwhelmed the population by making them authentic to such a base, and multitudinous fake malefactors were in control of the situation on a single face where everything from shopping to cooking to watching live sports events was made easier. In addition, a social networking community is a community which connects or adjoins one people or community with another people or community around the globe whose health and backgrounds are insolvable to distinguish. A healthy app like Facebook or LinkedIn allows a person to produce a particular runner that adjoins them to their given family or musketeers or like- inclined individualities and allows them to feel happy and proud. Advanced sweats to limit the internet usage for order and connecting on a following, ethical, educational, safety, and fresh base have redounded from the shocking shift in gregarious authority. These events have redounded in legal and limited sweats to reduce the pitfalls associated with this new normal, which include fraud, pornography, hacking, and hacking while druggies are alone, thinker property, public security, and stoner time alone. In this setting, the current exploration trouble is free to probe the use of social community networking websites and cyber security regulations in an applicable manner. In the present exploration bid, 100 repliers (scholars at universities in Jaipur, Rajasthan, India) who constantly use collaborative media gear for winning performance of their day- to- day lives were the subject of exploratory and regular cave into slant for data compendium and psychoanalysis. The views of the repliers were statistically anatomized using SPSS's One- Way ANOVA, and the issues redounded in a negative response to the null thesis and a positive response to the alternate thesis, which states that- H1- There's a significant association between the use of social networking spots and legal violations. The current study can be attributed to some of the well- known cases that made captions. The purpose of this study was to establish a link between the position of the collaborative medium and the specifics or reason for the prevalence in exaggerated statutory businesses.