Security Incidents Research Articles

“I don't think we're there yet”: The practices and challenges of organisational learning from cyber security incidents

Learning from cyber incidents is crucial for organisations to enhance their cyber resilience and effectively respond to evolving threats. This study employs neo-institutional and organisational learning theories to examine how organisations learn from incidents and gain insights into the challenges they face. Drawing on qualitative research methods, interviews were conducted with 34 security practitioners from organisations operating in the UK spanning a range of industries. The findings highlight the importance of consciously evaluating learning practices and creating a culture of openness to hear about incidents from employees, customers and suppliers. Deciding which incidents to learn from, as well as who should participate in the learning process, emerged as critical considerations. Overcoming defensiveness and addressing systemic causes were recognised as barriers to effective learning. The study emphasises the need to assess the value and impact of identified lessons and to avoid superficial reviews that treat symptoms rather than underlying causes to improve resilience. While progress has been made in learning from incidents, further enhancements are needed. Practical recommendations have been proposed to suggest how organisations may gain valuable insights for maximising the benefits derived from incident learning. This research contributes to the existing knowledge on organisational learning and informs future studies exploring the social and political influences on the learning process. By considering the suggested recommendations, organisations may strengthen their cyber security, foster a culture of continuous improvement, and respond effectively to the dynamic cyber security landscape.

Digital twin for multi-scenario emergency of railway passenger stations

Emergency disposal is a critical aspect for railway stations to ensure safety. This requires the implementation of emergency plan simulations and cost-effective immersive drills. In the paper, we incorporate a set of disposals for events into emergency processes and model the personnel, supplies, and equipment to create multiple emergency scenarios. Additionally, we introduce a digital twin-based solution for multiple scenarios of emergencies. This solution completely restores the key components of a station in the information space and provides an immersive way for emergency disposals. The four-dimensional model used in the solution simulates and interacts with the station, and it is composed of the details of passenger station physical entity, multi-scenario emergency virtual entity, digital twin connection, and emergency twin service. The digital twin for versatile emergency events such as fire disaster, natural disaster (e.g., flood, earthquake), social security incident, and public health event have been constructed using the model. The solution was tested at Qinghe, a station during Beijing-Zhangjiakou high-speed railway in China. By utilizing the actual operation data of Qinghe, we validated the multi-scenario emergency drills, simulated the corresponding emergency disposal plans, and assessed the proposed solution from three aspects: the fidelity of the real-world simulation, coverage of the multiple emergency scenarios, and the user-friendliness. The evaluations indicate that the proposed solution attains good score and the acceptable level of system usability scale.

Theft and Vandalism Control Measures on Construction Sites

Purpose: The goal of this study is to determine and improve the best security practices within Ghanaian construction sites to control theft and vandalism incidents.
 Design/Methodology/Approach: A purposive sampling technique was adopted for the population which were indigenous small and medium-sized construction firms of D1KI and D2K2 categories to complete the semi-structured questionnaire. Out of the total of 80 questionnaires distributed, only 65 responses were retrieved for analysis. Descriptive statistics comprising, frequencies and mean scores were used. 
 Findings: The findings showed that the most effective and often utilized security measure on construction sites is the hiring of watchmen, with security cameras, alarm systems, and warning signs being the least frequently employed. Sites would most likely be protected from theft by effective implementation of the most important security measures while also guaranteeing that the value for money invested in site security is also realized.
 Research Limitation/Implications: The effectiveness of theft and vandalism control measures may vary based on specific site characteristics, such as location, size, and type of construction. Generalising findings from one site to all construction contexts may not be applicable.
 Social Implication: Incidents of theft and vandalism can lead to social tensions within the community, especially if residents perceive construction activities as a source of risk. Effective control measures mitigate these tensions, fostering a more harmonious relationship between construction companies and the local population.
 Practical Implication: Minimizing the impact of theft and vandalism contributes to the timely completion of construction projects. Unanticipated delays due to security incidents can be avoided, ensuring that projects adhere to planned schedules and deadlines.
 Originality/ Value: The originality of this paper lies in its targeted investigation into theft and vandalism control measures on small and medium-sized construction sites, offering innovative and contextually relevant solutions that address the unique challenges faced by SMEs in the construction industry.

The Security Situation in the Pusht-e Kuh Government in the Late Qajar Era and the Role of Gholam Hossein Khan Shahab al-Mulk in It

In the final third of the Qajar period, the Pusht-e Kuh government faced various vulnerabilities, threats, and security incidents. Border disputes with the Ottoman Empire, internal uprisings, regional wars, dissatisfaction and lack of trust among subjects, mismanagement by some officials, and the involuntary migration of inhabitants led to severe security disruptions. Gholam Hossein Khan Shahab al-Mulk, a key figure within the ruling elite, was tasked with restoring order and took actions aimed at reproducing, improving, and enhancing security in the region. This study seeks to answer the question: What role did Gholam Hossein Khan Shahab al-Mulk play in the security of the Pusht-e Kuh government during the late Qajar period? It also tests the hypothesis that Shahab al-Mulk, through effective agency, strengthened the financial capacity, guided and reassured the subjects, improved intelligence, and implemented military and security measures, thereby improving security in Pusht-e Kuh during the late Qajar period. The present research has been conducted using a descriptive-analytical method, and a significant portion of the documents and materials reviewed in this study are being published for the first time. Additionally, the elite theory has been used as the theoretical framework of the research. The findings of the study indicate that Shahab al-Mulk was able to contribute to the maintenance and preservation of security in the Pusht-e Kuh government by improving financial resources, building trust and hope among the subjects, and implementing military and security measures.

Juridical Analysis of the Implementation of the ISPS Code (International Ship and Port Security Code) by Shipping Service Providers to Improve Security for Ships and Port Facilities (Research Study at the Port of Bintan Inti Industrial Estate Lobam)

The International Ship and Port Security Code (ISPS Code) is a comprehensive rule regarding measures to increase security for ships and port facilities, this rule was developed in response to perceived threats that could occur to ships and port facilities following the September 11, 2001 attacks on the United States. The problems in this research are legal regulations regarding the implementation of the ISPS Code in Indonesia, the implementation of the ISPS Code (International Ship And Port Security Code) by shipping service providers to improve security for ships and port facilities at the Port of Bintan Inti Industrial Estate Lobam, Obstacle Factors and Obstacles as well as solutions regarding ISPS (International Ship And Port Security) at Bintan Inti Industrial Estate Lobam Port. The research method used in this research is combined normative and empirical research with a juridical approach. The juridical approach is an approach taken by exploring the laws and regulations relating to the problem to be researched. The research method explains the entire series of activities that will be carried out in order to answer the main problem to prove the assumptions put forward. Legal regulations regarding the implementation of the ISPS Code (International Ship And Port Security Code) in Indonesia. ISPS Code (International Ship And Port Security Code) is an international regulation regarding the security of ships and port facilities. The ISPS Code consists of two parts, part A and part B. Part A contains mandatory requirements for: Government, Ships / Companies and Port Facilities. Part B contains guidelines: Background, Fulfillment, and Assistance. Maritime Security in the present and future tends to be disturbed/threatened. It is recommended for shipping service providers to establish a framework that involves cooperation between the governments of signatory countries, government agencies, local governments and the shipping industry and port industry to identify security threats and take preventive action against security incidents that impact ships or facilities. ports used for international trade to ensure sufficient confidence in the maritime and proportional security measures in place.

Spatial risk of Haemaphysalis longicornis borne Dabieshan tick virus (DBTV) in China.

The uncertainty and unknowability of emerging infectious diseases have caused many major public health and security incidents in recent years. As a new tick-borne disease, Dabieshan tick virus (DBTV) necessitate systematic epidemiological and spatial distribution analysis. In this study, tick samples from Liaoning Province were collected and used to evaluate distribution of DBTV in ticks. Outbreak points of DBTV and the records of the vector Haemaphysalis longicornisin China were collected and used to establish a prediction model using niche model combined with environmental factors. We found that H. longicornis and DBTV were widely distributed in Liaoning Province. The risk analysis results showed that the DBTV in the eastern provinces of China has a high risk, and the risk is greatly influenced by elevation, land cover, and meteorological factors. The risk geographical area predicted by the model is significantly larger than the detected positive areas, indicating that the etiological survey is seriously insufficient. This study provided molecular and important epidemiological evidence for etiological ecology of DBTV. The predicted high-risk areas indicated the insufficient monitoring and risk evaluation and the necessity of future monitoring and control work.

A Critical Review on Cybersecurity Awareness Frameworks and Training Models

Due to its inherent weaknesses, protecting data and maintaining its integrity is crucial in the changing world of cybersecurity. This evaluation employs a quantitative methodology to evaluate several cybersecurity awareness and training approaches to illuminate their efficacy in lowering costs and security incidents for a company while enhancing cyber resilience and security posture. Our thorough research, which is supported by actual evidence, emphasizes the real advantages of clear cybersecurity awareness and training activities. These measures enable businesses to drastically reduce security incidents and realize verifiable cost reductions. Additionally, these initiatives act as accelerators for improving overall cyber resilience, therefore bolstering an organization’s security posture. This in-depth analysis offers a data-driven perspective on these models’ respective capabilities and highlights the critical role that strategic cybersecurity education and awareness play in defending against a constantly changing threat environment.

Forenzika mrežnih napada - analiza tehnika, simulacija i programskih rešenja za zaštitu

This paper explores the application of programming code in computer network forensics, with a focus on methods for collecting, analyzing and preserving network data. We discuss various techniques and tools for detecting network threats, monitoring network traffic, and identifying anomalies that may indicate security incidents. The goal is to show how programming code can improve the efficiency of forensic investigations and enable more accurate analyses.

MalAware: A tabletop exercise for malware security awareness education and incident response training

Advancements in technology, including the Internet of Things (IoT) revolution, have enabled individuals and businesses to use systems and devices that connect, exchange data, and provide real-time information from far and near. Despite that, this interconnectivity and data sharing between systems and devices over the internet poses security and privacy risks as threat actors can intercept, steal, and use owners’ data for nefarious purposes. This paper discusses ’MalAware’, a ‘Malware Awareness Education’ and incident response (IR) scenario-based tabletop exercise and card game for malware threat mitigation training. It introduces the importance of incident management, highlights the dangers posed by malware for connected systems, and outlines the role of tabletop games and exercises in helping businesses mature their malware incident response capabilities. The study discusses the design of MalAware and summarises the results of 2 pilots undertaken to assess the concept, maintaining that the results highlighted the value of ‘MalAware’ as an essential tool to help students and staff master how to mitigate security threats caused by malware. It argues that MalAware can assist businesses in their IR preparedness endeavors, enabling incident management teams to review plans and processes to ensure they are fit for purpose. It enables staff to leverage scenario-based and simulated security breach examples, including role-play, to establish appropriate malware defences. MalAware’s practical hands-on exercises can assist trainees in gaining essential malware and other threat mitigation skills, helping to protect the security and privacy of IoTs.

A Compendium on Risk Assessment of Phishing Attack Using Attack Modeling Techniques

With the advent of new attacking methodologies and types of attacks, it has become difficult to protect the systems. Therefore, it is necessary to decipher the impact of attacks before and after its occurrence to provide better security. It is hard to speculate future attacks, without understanding the network vulnerability and therefore, it is important to examine the network for identifying potential vulnerabilities using attack modeling. Phishing attacks is one of the prominent network attacks that pose continual threat to the network and organization. This article presents and discusses in brief attack modeling techniques that can be applied for risk assessment. The paper presents in detail modeling of phishing attack using attack graphs, cyber kill chain, diamond model, security incident response matrix, and data description model. Moreover, the article also discusses role of network defenders and system engineers in assessing risk and how attack models can be helpful to them for modeling attacks. The review presented in this paper can serve as a platform for researchers in the field of network security and risk assessment for developing effective and secure network environment.

Methodology of investigation phishing attacks

The objective of this study is to develop a methodology for investigating phishing attacks. Materials from relevant articles and electronic resources on the topic of cybercrimes and their investigation were used for the methodology development. The study employs methods of analysis and synthesis, study and generalization, deduction, and induction. As a result of the analysis of the used materials, a methodology for investigating phishing attacks was developed, and its trial was conducted during the investigation of an incident related to a phishing attack in a budgetary organization. The practical contribution of this article is the potential application of the developed methodology in the investigation of phishing attacks. The scientific novelty of the methodology lies in its comprehensive and integrated approach to the investigation of phishing attacks, which improves the quality and speed of response to security incidents and strengthens preventive measures against phishing. Instead of a fragmented analysis of incidents, the proposed methodology uses a consistent and systematic approach, guiding the forensic expert’s actions from the moment of incident identification to the formation of a report. This approach ensures the completeness and continuity of the investigation process and allows to get a prompt response to attacks and minimize potential damage. Based on the analysis of a specific incident, recommendations are formulated, aimed not only at eliminating the consequences of a particular attack but also at preventing future phishing attempts.

A novel approach for enhanced abnormal action recognition via coarse and precise detection stage

<abstract> <p>With the proliferation of urban video surveillance systems, the abundance of surveillance video data has emerged as a pivotal asset for enhancing public safety. Within these video archives, the identification of abnormal human actions carries profound implications for security incidents. Nevertheless, existing surveillance systems primarily rely on conventional algorithms, leading to both missed incidents and false alarms. To address the challenge of automating multi-object surveillance video analysis, this study introduces a comprehensive method for the detection and recognition of multi-object abnormal actions. This study comprises a two-stage framework: the coarse detection stage employs an enhanced YOWOv2E model for spatio-temporal action detection, while the precise detection stage utilizes a two-stream network for precise action classification. In parallel, this paper presents the PSA-Dataset to address the current limitations in the field of abnormal action detection. Experimental results, collected from both public datasets and a self-built dataset, illustrate the effectiveness of the proposed method in identifying a wide spectrum of abnormal actions. This work offers valuable insights for automating the analysis of human actions in videos pertaining to public security.</p> </abstract>

Machine learning for QoS and security enhancement of RPL in IoT-Enabled wireless sensors

Internet of Things (IoT) networks rely on wireless sensors for data collection and transmission, making them vulnerable to security threats that undermine their Quality of Service (QoS). The Routing Protocol for Low-Power and Lossy Networks (RPL) is crucial for efficient data transmission in IoT networks, but its performance can be significantly degraded by attacks such as Rank, Sinkhole and Wormhole attacks. These threats disrupt network integrity by manipulating routing information, attracting traffic through malicious nodes and tunneling data to malicious endpoints. This paper presents a novel machine learning-based framework to enhance RPL's security and QoS. Our approach integrates a random forest model for precise traffic classification, a reinforcement learning module for dynamic and adaptive routing, and a modified RPL objective function that incorporates classification outcomes into routing decisions. Simulations demonstrate that our framework significantly improves network throughput, reduces latency, and enhances packet delivery ratios while maintaining low jitter. Furthermore, it achieves a high detection rate, minimal false positives, and swift response to security incidents, thereby robustly securing the RPL protocol and enhancing QoS in IoT-enabled wireless sensor networks. The findings of this research offer substantial contributions to the field, providing a comprehensive solution to strengthen RPL against prevalent security threats.

Evaluating the Influence of Attitude versus Knowledge and Individual Factor versus Intervention Factor on Information Security Awareness in Local Government

Local government as a public organization that typically collects mass amounts of sensitive data is one of the vulnerable and targeted sectors for information security attacks. The human aspect is the most critical but weak link to information security incidents. Among government organizations, local governments usually have more limited human resources either in number and competencies including information security awareness. This study aims to validate the Information Security Awareness (ISA) model for local government, including confirming the influence of knowledge and attitude on information security behavior, evaluating the stronger predictor between knowledge and attitude toward information security behavior, and analyzing the influence of gender (as an individual factor) and training (as an intervention factor) on the information security behavior. Utilizing the HAIS-Q assessment tool, this study collected responses from 704 employees of 68 departments/units under the government of East Java Province, Indonesia. The results suggest that in the local government context, there is a significant direct relationship between Knowledge of information security and information security Behavior and its indirect relationship via Attitude toward information security behavior. However, Attitude toward information security behavior has a stronger effect on Behavior than Knowledge. This study also suggests significant differences in information security behavior between employees who have trained and those who have not, regardless of gender. The proposed model suggests that to improve Information Security Awareness among employees, local government should focus on improving employees’ Attitudes toward information security behavior, either by improving their Knowledge of Information Security via training or their affective attitude toward information security behavior.

Rapid visualization of large arrays of heterogeneous data of cyber security events

The paper discusses the problem of operational design of data visualization for visual analysis of large arrays of heterogeneous data from information security systems. Since security systems today process large volumes of heterogeneous data, proper visualization is required to work more effectively with this data. For this reason, prototypes of rapid visualization components have been developed and presented for various information security tasks, which will allow the operator to visually search for anomalies and investigate security incidents. Moreover, an additional classification of visualization models has been developed, which will allow developers of such systems to select models that are most suitable for solving a specific problem.

Extended Fuzzy Neutrosophic Classifier for Accurate Intrusion Detection and Classification

Intrusion Detection is crucial in contemporary cybersecurity landscapes to proactively thwart and identify possible threats. The risk of data breaches, malicious activities, and unauthorized access escalates as organizations increasingly rely on interconnected systems. Intrusion Detection Systems (IDS) are imperative for the continuous monitoring of system and network activities, quickly identifying patterns or anomalies indicative of cyber threats. IDS acts as a frontline defense mechanism with the ability to identify abnormal behaviors and known attack signatures. Prompt recognition allows for safeguarding sensitive data, timely response, fortifying the overall resilience of IT infrastructures, and reducing the effect of security incidents. The implementation of robust IDS is vital in an era marked by evolving cyber threats to ensure the confidentiality, availability, and integrity of digital assets. This study develops an improved Arithmetic Optimization Algorithm with an Extended Fuzzy Neutrosophic Classifier technique (AOA-EFNSC) for Accurate Intrusion Detection and Classification. The main goal of proposing this model is to recognize the presence of intrusions effectually. A min-max scalar is applied to normalize the input data before using the improved AOA as a feature selection method. For intrusion detection, the proposed model uses the FNSC technique for the recognition and classification of the intrusions. A sequence of experimentations was involved to validate the superior performance of the proposed model. The experimental value pointed out that our proposed approach outperforms the previous models and enhances the intrusion detection results.

СРАВНИТЕЛЬНЫЙ АНАЛИЗ РЕШЕНИЙ КЛАССА DDP ДЛЯ ЗАЩИТЫ ИНФРАСТРУКТУРЫ ПРЕДПРИЯТИЙ

The article considers the use and implementation of modern solutions in the field of deception technologies in the information infrastructure of critical industrial facilities. Their advantages and key features of use are analyzed, the principle of operation of the distributed infrastructure of false goals is considered. A comparative analysis of six different DDP class solutions of foreign and domestic manufacturers is carried out according to four criteria: the possibility of agentless placement of baits; types of traps and baits for industrial systems; information security systems with which the solution interacts; FulloS trapping possibilities. The approach to the implementation of DDP class solutions to ensure the information security of critical industrial facilities is substantiated. Within the framework of the considered approach, the implementation is proposed in the form of five major stages of setting up and implementing a distributed structure of false goals. The prospects of using DDP solutions to improve the safety of industrial enterprises are evaluated and an example of the effective use of the DDP class solution for an industrial facility is given. The prospects of using a distributed structure of false targets for critical industrial facilities are proposed to be assessed by the threat modeling, threat risk assessment and determination of the average number of information security incidents.

Resilient Chain: AI-Enhanced Supply Chain Security and Efficiency Integration

In most recent time, the global landscape of supply chain management has experienced unprecedented challenges during the COVID-19 pandemic, which has significantly impacted the routine and smooth operations of different firms in the United States. This paper explains about the importance of artificial intelligence (AI) and machine learning (ML) in the mitigation of these disruptions and possible ways of improving supply chain security and its efficiency. This research adopted a questionnaire survey involving 281 managers, with the aim to comprehensively examine the current state of AI integration across the U.S. supply chain sector, with focus on some key components like real-time tracking, cost optimization, and risk management. A mixed method approach was adopted for this research, utilizing both inferential and descriptive analyses to unravel insights and trends into the role of AI in enhancing supply chain security. The results indicate that integrating AI, most especially through cost optimization, real-time tracking, and risk management components, emerges as a significant determinant of supply chain security in the United States. Real-time tracking technologies are identified as crucial for monitoring shipments and assets, enabling quick responses to security incidents, and ensuring end-to-end visibility throughout the supply chain. Despite the potential benefits, the study highlights challenges that hinder the widespread integration of AI technologies in the U.S. supply chain. The high cost of AI adoption and the limited availability of skilled personnel are major obstacles. To address these challenges, the paper proposes practical recommendations. Firstly, real-time tracking technologies are recommended to monitor shipments and assets, facilitating rapid responses to security incidents, and ensuring visibility across the entire supply chain. Furthermore, the paper suggests optimizing costs by investing in cost-effective security solutions. This includes leveraging AI for automated monitoring systems and adopting secure packaging measures. These strategies aim to minimize vulnerabilities without compromising security standards, offering a balanced approach to enhancing supply chain security while mitigating the financial implications associated with AI adoption.

Feeling safe online and experience with cyber incidents among university students

The field of education increasingly depends on technology to manage extensive volumes of information, underscoring the paramount importance of cybersecurity. Security breaches are rising within the education sector, necessitating the preemptive improvement of awareness. Within this article, we will delve into the findings of a survey that inquired with university students about their perceptions of safety in the digital realm and their encounters with cybersecurity events. The outcomes shed light on the fact that while a majority of students do perceive online safety, a noteworthy portion has already encountered security incidents.

The Role of Mining and Detection of Big Data Processing Techniques in Cybersecurity

Abstract The need for advanced detection methods has become more critical in light of the increasing prevalence of network security incidents. This study proposes a novel approach to network security detection using a fuzzy data mining algorithm, addressing the rising challenges in big data processing and network security. The paper outlines the evolution of big data analytics by exploring the integration of network security detection, data mining, and structural feature analysis. Data for this research was collected using a sniffer device and underwent extensive preprocessing to ensure diversity and applicability. To overcome the limitations of traditional data mining, such as the issue of sharp boundaries, this method combines fuzzy logic with data mining techniques, enhancing conventional network security protocols. Simulation experiments demonstrate the efficacy of this fuzzy mining-based approach, with results showing 987,238 predicted positive cases, 93,951 of which were accurate. The method achieves an impressive 93.65% accuracy and 92.55% recall rate, proving its capability to promptly identify and mitigate suspicious network activities.