Protection Of Information Assets Research Articles

Development of A Risk Management System To Reduce The Impact of Cyber Threats

Cyber threats are one of the main issues in the digital era. Cyberattacks can result in financial, reputational and even operational disruption for organizations. In an effort to overcome this, organizations need to have an effective risk management system to identify, assess and manage cyber risks. The aim of this research is to determine the effectiveness of a risk management system that can help organizations reduce the impact of cyber threats. This study used qualitative research methods. The data collection technique in this research is literature study. The data that has been collected is then analyzed in three stages, namely data reduction, data presentation and drawing conclusions. The research results show that developing an effective risk management system is an important step for organizations in reducing the impact of cyber threats. A good risk management system can help organizations protect information assets, increase cyber resilience, and build customer trust.

CLUSTER ANALYSIS FOR RESEARCHING DIGITAL FOOTPRINTS OF STUDENTS IN EDUCATIONAL INSTITUTIONS

It is shown that Cluster Analysis (CA) can be used in the process of researching the Digital Traces (DT) of students of an educational institution, as well as other educational institutions that introduce a Digital Educational Environment (DEE) into the educational process. Cluster analysis can reveal behavioral patterns of education seekers. Also, the use of CA methods will improve the personalization of training and increase the effectiveness of educational programs. It is shown that in the context of ensuring Information Security (IS) of the DEE of educational institutions, technologies and methods of DT analysis can also be useful, for example, for: monitoring students’ network activity; analysis of student authorization and authentication logs; detection of malicious programs and attacks on the DEE; analysis of IS threats to the DEE as a whole; vulnerability prediction. It is shown that the application of CA methods can be useful in studying the degree of information security of the DEE of universities and other educational institutions. It has been established that CA methods can help identify groups of students with similar patterns of activity from the point of view of IS, both the DEE of the educational institution as a whole, and its computer networks and systems. It has been established that with the help of CA DT, it is possible to detect anomalous behavior of students, to detect unusual patterns of activity, facts of unauthorized use of resources or other deviations from the typical behavior of students in the network of the educational institution. The article also provides the results of experimental studies of the level of competences of students of various specialties at the university in IS and protection of information assets of the DEE. In this, CA methods were used in the process of studying students’ DT. Six types of users were distinguished on the basis of CA DT of different groups of students registered in the university DEE. As a result of the application of CA methods, students registered in the university’s DEE were divided into appropriate clusters according to criteria affecting IS risks.

RİSK MANAGEMENT IN İNFORMATİON EXCHANGE

The field of risk management is one of today's most main fields. Risk-free business is not possible. It is necessary to calculate the risks that arise in every business so that it does not create any problems for us later. Although it is not possible to reduce the risk to zero, it is possible to reduce the risk. One of the most utilised areas of the risk term is the risk of informatisation. Ensuring the confidentiality, integrity and transparency of information is one of today's main problems. For this purpose, some standards and standards have been prepared. Some of these standards are ISO 27001 and ISO 31000. With the widespread use of computer networks and the Internet, Information Security has become very important. Since organisations are mostly dependent on information, technology and systems, Information Security is of vital importance and the need to protect information assets from damage arises from this. On the other hand, many companies still do not take adequate and necessary measures in information security. As a result, many companies, including many large and international organisations, are under serious threat. In order to be able to recognise these threats in advance and to reduce the severity of threats, it is necessary to comply with the Risk Management and the whole of the ISO 27001:2022 standard. Today, organisations face a risk in almost every transaction. It is necessary to identify and evaluate the risks that may arise during the functions of the institutions carefully and in detail in advance and to take measures to minimise or completely eliminate these risks. In this article, the steps to be taken to meet the requirements of ISO 27001:2022 Information Security Management System Risk Management are analysed step by step and a software has been developed to enter the data containing these requirements and receive the relevant reports. In this context, the ISO 27000:2018 family referenced by the ISO 27001:2022 Standard has been examined. The ways in which risk analyses can be performed and how risk improvement can be achieved have been investigated. As a result of the study, all these have been brought together in a software and made reportable. The security structure should be established by taking into account the differences of the organisation and the system. Afterwards information security risk management and methods that are not fully detailed in the standard. A documentation by analysing assets under a corporate information processing structure has been created. To create this structure and at the same time to create a dynamic a basic level of information security control software has been produced to provide control. Keywords: Information, information security, risk, risk management, risk analysis.

Analysis of digitalization changes and their impact on enterprise security management under uncertainty

Purpose. To analyze the changes caused by the acceleration of digitalization under conditions of uncertainty and note their impact on enterprise security management in this environment. Methodology. The methodological basis for the study was the theoretical provisions of enterprise security; legal regulations governing security and information protection, scientific works by domestic and foreign scholars on the issues of enterprise security management. The methods of analysis, synthesis, deduction, generalization and cognition were used in the study on the issue. Findings. The conditions of functioning of enterprises are analyzed, in particular, the security of enterprises is considered in conditions of uncertainty caused by the martial law imposed in Ukraine and the acceleration of digitalization of business processes as a result of the emergence of new challenges. Originality. A number of events are traced that preceded the increased interest in electronic services and active investment by enterprises related to e-commerce; artificial intelligence, big data; technology. The basis is investigated for the emergence of new challenges and threats associated with the active use of the Internet, applied solutions, servers, big data, data processing methods, the use of third-party software, i.e. the risks of violating the integrity, reliability, and confidentiality of information. The trends in measuring enterprise security are analyzed and the factors that strengthen the role of protecting information assets of enterprises and organizations are identified. It is proposed to pay more attention to ensuring the security of enterprises, taking into account not only physical but also invisible intrusions, such as: threats to information, the information field of enterprise functioning through a consistent response to cyber incidents/cyber-attacks by providing cybersecurity actors with protective stages: preparation, detection and analysis, deterrence, elimination, recovery, analysis of the efficiency of measures to respond to cyber incidents/cyber attacks. Practical value. The analysis carried out proves the relevance of the issues of enterprise security, the formation of changes in views on enterprise security in accordance with current trends and uncertain conditions. The findings of the study can be taken into account and practically implemented in the formation of the enterprise security policy, regardless of the field of activity.

Understanding employees' perceptions of SETA events: the role of pedagogical and communication approaches

PurposeSecurity education, training and awareness (SETA) programs are the key to addressing “people problems” in information systems (IS) security. Contrary to studies using conventional methods, the present study leveraged an “event” lens and dimensionalized employees' perceptions into three sub-dimensions: perceived novelty, perceived disruption and perceived criticality. Moreover, this research went a step further by examining how pedagogical and communication approaches to a SETA program affect employees' perceptions of the program. This study then investigated whether – and if so, how – these approaches impact employees' perceptions of the SETA program and their subsequent commitment to it.Design/methodology/approachUtilizing a factorial-based scenario survey, this study empirically tested a model of the above relationships via covariance-based structural equation modeling.FindingsThe results of this research showed that pedagogical approaches were more effective than communication approaches and that employees' perceptions of the SETA program accounted for a large variance in their commitment to SETA.Originality/valueFirst, this research deepens understanding of the protection of information assets by elaborating on the different approaches that organizations can take to encourage employees' commitment to SETA. Second, the study enriches the SETA literature by theorizing a SETA program as an organizational “event”, which represents a major shift from the conventional approach. Third, the study adds to the theoretical knowledge of the event lens by extending it to the SETA context and investigating the relationship among three event strength components.

The Institutionalisation of Information Security Management Practices in selected Organisations in Uganda

The study aimed at examining the extent to which information security management practices were institutionalised in corporate organisations. Evidence shows that failure by organisations to entrench the information security management practices (ISMPs) into organisations’ structures opens the gateway for attacks, threat actors and information breaches to cause harm to information assets with ease. The study explored the phenomenon in its social setting hence the adoption of descriptive research design as the research methodology. The institutional theory was adopted as a new dimension in examining information security management in organisations. This theory suggests that control gears like coercive, normative, mimetic and management commitment could be used to effectively entrench security guidelines in organisations. Methodical scrutiny of the institutionalisation process: development, implementation and maintenance, and evaluation were also carried out. The researcher relied on human experience to make sense of the institutionalised processes. Extant literature was reviewed, and survey questionnaires were developed based on the eleven ISMPs and administered to purposively selected respondents from the two organisations. The eleven ISMPs covered include state of information security policy, asset management, secure information sharing, supply chain security, access management, network security controls, portable and removable media security, remote access security, protective monitoring of information systems, implementation of information security back-ups, and security accreditation by professional bodies. Data analysis was done using SPSS. Findings indicate that organisations have not fully incorporated all the eleven ISMPs covered as best practices and standards. Based on the results from the field, answers to the research questions were partly realised. Recommendations like the implementation of ISMPs to check deficiencies identified, customisation of security guidelines to protect information assets and institutionalisation of security practices at all levels were suggested. Overall, the study was a positive step towards the institutionalisation process of ISMPs in organisations

Cybersecurity and Mental Health in the Digital Age

More than half of the world population is connected through the Internet and end users and professionals alike spend many hours on it to communicate, research, work, collaborate and socialize, generating millions of bytes of data daily. Cybercriminals are also taking the advantage to hack systems and steal or corrupt data, disrupt operations and the level and intensity cyber-attacks have increased tremendously, since the Russia invasion of Ukraine. Individuals who have been affected by cybersecurity breaches have been known to develop increased anxiety levels, fear of others online, leading to depression. Cybersecurity professionals are also under pressure to perform and continually prevent attacks and protect information assets. Many of these incident responders have experienced workplace stress, burnout, depression, suicidal thoughts and some quitting the cybersecurity industry due to pressures to keep away all cyber- attacks. All these scenarios of cybersecurity breaches have implications on mental health. This paper did a systematic review to find correlations between cybersecurity and mental health. The findings revealed that as a result of cybersecurity breaches, both users and professionals have developed mental health conditions including anxiety, stress, burnout, depression, suicide thoughts and some professionals quitting the industry and further increasing the skills shortage. The paper concluded that there is a positive correlation between cybersecurity breaches and mental health and we should all be conscious of this and balance our work-life lifestyle; employers should encourage discussions around mental health, provide counselling services and invest in cybersecurity resources and further education to motivate professional staff and reduce cybersecurity skills shortage. Keywords — Cybersecurity, Mental Health, Digital Age, Industry, Cyberspace, Lifestyle

Health information systems security: Risks, prospects and frameworks

Information is the most precious asset of any organization and assessing risk to information is a core mandate of any institutional management to ensure availability of effective controls to protect information assets. The increasing digitization of health information and the ever-changing cyber security threat environment, has led to some public health data breaches and as information security become increasingly important to the continued success for businesses, majority of organizations are searching for an appropriate security framework. Security risk assessment framework enables identification of threats and vulnerabilities. Although numerous frameworks available in the market, selection of the right framework to meet the organization’s need is a challenge due to lack of prescriptiveness, standard, inconsistencies, complexity, compliance, cost, and certifications. To address the gap, this study assessed the security of health information system and privacy risks in addition to existing frameworks and developed an enhanced framework. The study adopted a descriptive cross – sectional design and was conducted in Siaya County, in Kenya. A questionnaire was used to collect data which was analyzed and presented inform of tables, and charts. The results indicated that confidentiality of information is good (use of identifiers and passwords at 96.8% approval rate), availability of physical controls to protect authorized access at 95.2%, availability of policies stating staff responsible for protection of information confidentiality at 91.9%, availability of written policy on patient confidentiality and privacy at 74.2% and use of access privileges at 68.8%. The findings on integrity of information was poor with availability of systems to review data accuracy having 71.9% approval rate, frequency of data review at 81.2%, availability of written description of information security manager’s responsibility at 39.5%, monitoring of electronic systems to detect potential breaches at 40%, creation of audit logs to track system transactions at 54% and frequency of reviewing audit logs at 51.5%. The findings on availability of information was good (availability of inventory of computers at 69.9%), regular updates of inventory at 61.3%, updates of patient data on laptops and desktops at 68.2%, sharing of data confidentiality and security policy at 36%, and regular backups of audited logs at 51% approval rates. Regarding the assessment of existing security frameworks, it was noted that HIPAA has the following shortcomings: lacks complete valid risk analysis, not certifiable, security rule is safeguarding electronic protected health information only, the security does not regulate emails and does not require encryption, and commitment on security is verbal. On the other hand, ISO/IEC 27001 is expensive, requires specific IT budget, special expertise, and more time to apply in public hospitals. Finally, NIPP framework is expensive, and uses consequence’s assessment which is outside the scope of this study.

Principles of information security management system

The main element of a complex system that determines its performance and efficiency is its management system. Modern management systems are widely used, including in the management of teams of people united by common goals (organizations, departments, groups of developers, etc.). Information security is no exception - it is not enough to saturate the division responsible for information technology security with personnel, technical systems of information protection, it is necessary to ensure the effectiveness in achieving the goals, which is not possible without an appropriate management system. Information security specialists in organizations of various forms of ownership often face the problem of ensuring effective and efficient protection of information assets. Availability of international and national standards, regulatory documents of regulators does not ensure the achievement of high performance and efficiency indicators. The achievability of these indicators is determined by setting and achieving a number of goals, based on certain strategic principles of information security management system.

The Implementation of Information Security for the Inventory System in a Municipality of Lima-Perú

In recent years, digital transformation has played an important role in all companies investing in technology. This investment greatly contributes to the daily tasks that companies carry out and can mean notable business growth. Also, it brings vulnerabilities that can be exploited by malicious people who, for any reason, seek to damage or appropriate the company's resources, thus directly or indirectly affecting business operations, which is why it is necessary to prevent these acts of vulnerability with the realization of information security. That is why the materials used to implement information security are explained in this work. The purpose of the research work is to identify, analyze, and evaluate to deal with the risks, thus better controlling the risks. This allowed us to land it in the conclusions made based on the objective and methodology used. It allowed us to have a sequence divided into three stages: initiation, planning, and execution. This helps us identify the infrastructure, times, risks, controls, policies, and information assets, in addition to evaluating and treating each risk identified in the District Municipality of Jesás María. This study showed that the implementation of information security has a positive impact since it helps make decisions for the protection of information assets.

An Empirical Study of Intelligent Security Analysis Methods Utilizing Big Data

The frequency of cyber-terrorist attacks targeting broadcasting companies or key financial institutions, in which PCs affected by malicious code obstruct normal operations, has been increasing. With the widespread availability of internet technology, the frequency of intelligent cyber-attacks in virtual cyber environments, such as APT attacks, continues to rise. Through an intelligent analysis of cyber threats which are still unknown, it is possible to prevent security accidents before they occur through the use of intelligent security analysis methods based on big data. The researcher conducted this empirical study concerning intelligent security analysis methods utilizing big data which are capable of preventing cyber threats, while protecting information assets from risks through evaluation and prediction.

Information security cultural differences among health care facilities in Indonesia

BackgroundHealth information security (IS) breaches are increasing with the use of information technology for health care services, and a strong security culture is important for driving employees' information asset protection behavior. ObjectiveThis study aimed to analyze differences in information security cultures (ISCs) across health care providers based on factors drawn from the ISC model. MethodsWe used twelve factors to measure the ISCs of health care providers. This research applied a survey method with the Kruskal–Wallis H Test and the Mann–Whitney U Test as data analysis techniques. We collected the data through a questionnaire distributed to 470 employees of health care facilities (i.e. hospitals, community health centers, and primary care clinics) in Indonesia. ResultsThe results revealed the differences between health care provider types for 9 of the 12 security culture factors. Top management support, change management, and knowledge were the differentiating factors between all types of health care providers. Organizational culture and security compliance only differed in primary care clinics. Meanwhile, security behavior, soft issues and workplace independence, information security policies, training, and awareness only differed in hospitals. ConclusionThe results indicated that each type of health care provider required different approaches to develop an ISC considering the above factors. They provided insight for top management to design suitable programs for cultivating ISCs in their institutions.

A Dense Neural Network Approach for Detecting Clone ID Attacks on the RPL Protocol of the IoT.

At present, new data sharing technologies, such as those used in the Internet of Things (IoT) paradigm, are being extensively adopted. For this reason, intelligent security controls have become imperative. According to good practices and security information standards, particularly those regarding security in depth, several defensive layers are required to protect information assets. Within the context of IoT cyber-attacks, it is fundamental to continuously adapt new detection mechanisms for growing IoT threats, specifically for those becoming more sophisticated within mesh networks, such as identity theft and cloning. Therefore, current applications, such as Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), and Security Information and Event Management Systems (SIEM), are becoming inadequate for accurately handling novel security incidents, due to their signature-based detection procedures using the matching and flagging of anomalous patterns. This project focuses on a seldom-investigated identity attack—the Clone ID attack—directed at the Routing Protocol for Low Power and Lossy Networks (RPL), the underlying technology for most IoT devices. Hence, a robust Artificial Intelligence-based protection framework is proposed, in order to tackle major identity impersonation attacks, which classical applications are prone to misidentifying. On this basis, unsupervised pre-training techniques are employed to select key characteristics from RPL network samples. Then, a Dense Neural Network (DNN) is trained to maximize deep feature engineering, with the aim of improving classification results to protect against malicious counterfeiting attempts.

An Investigation of the Information Security Awareness and Practices among Third Level Education Staff, Case Study in Nalut Libya

The development of Information and Communication Technologies (ICTs) is becoming very common throughout society. Therefore, it is a must to protect information assets. In addition to the technological aspect, research continues to confirm the need to enhance security awareness among employees. The objective of this study is to investigate the factors that may impact users’ practice and awareness both in the workplace. Specifically, factors such as policy, behavior, training, knowledge of IT and education were tested. In addition, the second objective of this study is to investigate the information security awareness and practice level among the employees. To achieve the study objectives, a quantitative methodology was applied; specifically a survey instrument was developed to measure if each of the key factors has a significant association within the security awareness and practice in the workplace. 202 usable surveys were collected from higher education employees and analyzed using Bivariate/Pearson Correlation to determine the relationship between the independent variable and the dependent variable. The findings of the study revealed that there was a positive correlation between policy, behavior, training, knowledge of IT and education with security awareness and practice These results indicated that security awareness and practice level of employees' in the workplace at the middle level. It is hoped that the present study provides an initial step to focus on security training sessions among higher education employees to reflect new knowledge on the importance of security training to increase the knowledge of information security.

Exploring the role of intrinsic motivation in ISSP compliance: enterprise digital rights management system case

PurposeEmployee compliance with information system security policies (ISSPs) has been emphasized as a key factor in protecting information assets against insider threats. Even though previous studies have identified extrinsic factors (in the form of external pressure, rewards and social norms) influencing employee compliance, the functioning of employees' intrinsic motivation has not been clearly analyzed. Thus, the aim of this study is to explore the influence of intrinsic motivations on employees' ISSP compliance.Design/methodology/approachThis study follows a survey approach and conducts structural equation modeling using WarpPLS 5.0 to test the research model and hypotheses. The survey respondents are users of an enterprise digital rights management (EDRM) system.FindingsThe analysis results demonstrate that work impediments, perceived responsibility and self-efficacy significantly influence the intention to comply with ISSP. Additionally, autonomy significantly affects self-efficacy and perceived responsibility. Furthermore, autonomy plays a moderating role in the relationship between work impediment and ISSP compliance intentions.Originality/valueThis study initiatively explores the effect of intrinsic motivations on ISSP compliance intention of employees for a specific information security system (i.e. the EDRM system). This study clarifies the enabling role of intrinsic motivations in ISSP compliance and helps organizations to understand that employee's self-motivated intention, i.e. autonomy, is an essential factor that achieves a higher level of ISSP compliance in the workplace.

Порівняльний аналіз моделей оцінки зрілості інформаційної безпеки

Інформаційна безпека може бути визначена як: захист інформаційних активів за допомогою обробки ризиків, спрямованих на порушення конфіденційності, цілісності та доступності інформації, яка обробляється, зберігається і передається між взаємопов'язаними інформаційними системами; процес, який включає запобігання, виявлення і реакцію на загрози інформаційній безпеці. Мета даної статті - описати і порівняти найбільш використовувані моделі зрілості інформаційної безпеки для аналізу їх відповідності цілям використання спільно з стандартом ISO 27001. У статті показано, що моделі зрілості інформаційної безпеки мають схожі елементи, домени і рівні зрілості. Вони також грунтуються на оцінці ризиків, хоча і на різних рівнях глибини. Було відзначено, що кожна модель в силу своєї специфіки має різні сфери застосування. У світовій практиці для визначення стадії організаційного і технологічного розвитку організації і її процесів застосовується поняття моделі зрілості. Для вимірювання стану процесу використовується набір метрик, які представляють собою певні характеристики. Оцінювання цих метрик за встановленою шкалою показує стан процесів, яке і буде характеризувати рівень їх зрілості. У світовій практиці, на відміну від української, застосування моделі зрілості для управління процесами інформаційної безпеки широко поширене. Прикладом цього може служити серія стандартів ISO27000, яка регулює питання управління інформаційною безпекою, що реалізуються на основі Системи Управління Інформаційною Безпекою. Очевидно, що перед організацією, що здійснює діяльність з управління інформаційною безпекою, рано чи пізно постає питання про те, як виконувати ці вимоги, в якому обсязі і на якому рівні деталізації і т.п. Відповісти на ці та інші питання може допомогти модель зрілості, на основі якої буде проводиться оцінка рівня зрілості процесів інформаційної безпеки. Для визначення основних моделей зрілості інформаційної безпеки було проведено аналіз відкритих джерел і кращих практик, пов'язаних з моделями зрілості інформаційної безпеки. На підставі результатів аналізу джерел були визначені найбільш прийнятні моделі зрілості інформаційної безпеки, а саме: SSE-CMM, C2M2, NICE і O-ISM3.

Leveraging intrinsic resources for the protection of health information assets


 
 
 The prevailing state of rural economies continues to constrain the use of digital applications for improved healthcare. These constraints are attributed to the unavailability of key infrastructure and financial resources. Moreover, a prevailing shortage of skilled health workers highlights the critical role digital solutions have to play in alleviating health service delivery challenges. Resource-constrained settings need secure low cost and long shelf-life solutions that leverage existing resources to provide adequate and secure health services. The objective of this paper is to identify the existing resources that can be engaged in the protection of the broader health information assets (including digital applications). To meet the objective, a single case study was conducted. Questionnaires were distributed to twenty-five Community Health Workers to identify existing stressors and resources in the context. The paper leads with a description of resource-constrained settings, highlights the challenges facing healthcare systems in these contexts and emphasizes the need for health information asset protection. The findings, recommendations and conclusions are subsequently presented. The contribution of this paper is a set of recommendations for improving health information asset protection in resource-constrained settings as informed by stressors and resources identified in the case study.
 
 

A Survey on Crypto-Steganographic Schemes and A Use Case in Healthcare System

Information sharing has become prevalent due to the expansion of social networking in this 21st century. However, electronic devices are vulnerable to various kinds of attacks. Information might be disclosed, modified and accessed by an unauthorised third party which consequently leads to the breach of confidentiality, integrity and availability of the information. Therefore, it is of utmost importance to employ the technology of cryptography and steganography to protect information assets. Cryptography and steganography have weaknesses when they are working alone. Therefore, crypto-steganography, the combination of cryptography and steganography are introduced to overcome the weaknesses in order to provide a double layer of security and protection. This paper provides a general overview of steganography and cryptography as well as a comparison analysis of different crypto-steganographic schemes. A secure crypto-steganographic system for healthcare is then developed with the implementation and integration of the secure crypto-steganographic scheme proposed by Juneja and Sandhu. This healthcare system enables users to store and deliver message in a more secure way while achieving the main goals of both cryptography and steganography.

A Survey on Crypto-Steganographic Schemes and A Use Case in Healthcare System

Information sharing has become prevalent due to the expansion of social networking in this21st century. However, electronic devices are vulnerable to various kinds of attacks. Information might be disclosed, modified and accessed by an unauthorised third party which consequently leads to the breach of confidentiality, integrity and availability of the information. Therefore, it is of utmost importance to employ the technology of cryptography and steganography to protect information assets. Cryptography and steganography have weaknesses when they are working alone. Therefore, crypto-steganography, the combination of cryptography and steganography are introduced to overcome the weaknesses in order to provide a double layer of security and protection. This paper provides a general overview of steganography and cryptography as well as a comparison analysis of different crypto-steganographic schemes. A secure crypto-steganographic system for healthcare is then developed with the implementation and integration of the secure crypto-steganographic scheme proposed by Juneja and Sandhu. This healthcare system enables users to store and deliver message in a more secure way while achieving the main goals of both cryptography and steganography

Ethical Value-Centric Cybersecurity: A Methodology Based on a Value Graph.

Our society is being shaped in a non-negligible way by the technological advances of recent years, especially in information and communications technologies (ICTs). The pervasiveness and democratization of ICTs have allowed people from all backgrounds to access and use them, which has resulted in new information-based assets. At the same time, this phenomenon has brought a new class of problems, in the form of activists, criminals and state actors that target the new assets to achieve their goals, legitimate or not. Cybersecurity includes the research, tools and techniques to protect information assets. However, some cybersecurity measures may clash with the ethical values of citizens. We analyze the synergies and tensions between some of these values, namely security, privacy, fairness and autonomy. From this analysis, we derive a value graph, and then we set out to identify those paths in the graph that lead to satisfying all four aforementioned values in the cybersecurity setting, by taking advantage of their synergies and avoiding their tensions. We illustrate our conceptual discussion with examples of enabling technologies. We also sketch how our methodology can be generalized to any setting where several potentially conflicting values have to be satisfied.