Critical Infrastructure Security Research Articles

Cybersecurity In The Digital Age: Developing Robust Strategies To Protect Against Evolving Global Digital Threats And Cyber Attacks

In today's digital era, cyber security is a growing challenge, considering increasingly sophisticated cyber attacks and increasing global digital threats. These threats not only pose risks to individual privacy but also to the security of critical infrastructure and the country's economic interests. The need to develop a robust and adaptive cybersecurity strategy is critical to protecting digital assets and maintaining information security. This research aims to analyze the global cyber threat landscape and develop effective cyber security strategies to counter evolving digital threats. The method used is a descriptive qualitative approach by collecting and analyzing data from relevant previous studies. The results of the research show that an effective cybersecurity strategy requires an adaptive and innovative approach, utilizing the latest technology and cross-sector collaboration. The importance of international collaboration and human resource development in the field of cyber security was emphasized as a key factor in building stronger defenses against cyber attacks. Analysis of global cyber threats and their threat actors provides insight into the importance of cybersecurity education and awareness at all levels of organizations and society. The security strategy developed must be able to adapt to changes in technology and attack tactics to ensure effective protection. Cross-sector collaboration and the development of a strong cybersecurity ecosystem are the foundations for facing future cybersecurity challenges.

Cyber Security; Etiology and Importance

Background: Cyber Security is to protect online data and software from cyber threats. These cyberattacks are typically intended to gain access to, change, or delete sensitive information; extort money from users; or disrupt regular corporate activities. It is difficult to keep up a regular follow up with new technologies, so it is necessary to keep the important data safe from cyber threats. There are many types of cyber threats, malware, ransomware, social engineering, phishing etc. To prevent cyber-attacks one can, use password manager tools like LastPass and others. People also use two factor authentication for double security on their accounts. Methods: Boards such as the National Institute of Standards and Technology (NIST) are developing frameworks to assist firms in understanding their security risks, improving cybersecurity procedures, and preventing cyber assaults. The fight against cybercrimes and attack, organizations needed a strong base there are 5 types of cyber securities: Critical Infrastructure Security, application security, network security, cloud security and (IoT) Security. In the modern time the US is highly based on computers and on different software, so it is really important for the US to be more conscious about the security as they get many threats almost every day for hacking their data and accounts. Results and Conclusion: Nowadays, even small businesses rarely recover their loss from the cyber-attacks and many back-off from continuing their businesses after being target of hackers. The first cybercrime attack was recorded in 1988 by a graduate student. Now that large companies and even small businesses are aware of cyber-attacks, they try their best to take every precaution to prevent hacking with double security and password manager tools.

The Concept of a Method for Predicting the Cascade Effect Under Conditions of Hybrid Warfare

Abstract The changing nature of conflicts is creating new challenges in civilian protection. Features of hybrid warfare, such as multidimensionality, synergistic effects, blurring of boundaries, or asymmetricity, force practitioners and scholars to consider new threats. The article examines how the characteristics of hybrid warfare affect the emergence of cascade effects. We conducted research on examples of the war in Ukraine and the Israeli-Palestinian war. The concept of a method for predicting the cascade effect under conditions of hybrid war is proposed. The concept involves using the Six Ways to Die method to take areas affecting the health and life of the civilian population and define a network of object dependencies on which proper functioning of the State in these areas depends. Using complementary tools such as process analysis, risk assessment, Petri nets, and Bayesian network in the form of the Critical Infrastructure Security Situational Management methodology, the authors provide a comprehensive solution for modeling how to protect the life and health of the civilian population. To the author’s knowledge, this is the first holistic study in this issue.

Analysis of terminology for identifying the risks of ensuring security and sustainability of critical information infrastructure in Ukraine

The article is devoted to the definition of the concept of risk in the context of ensuring safety and sustainability of critical information infrastructure in Ukraine. It has been specified that, in general, the risks, which may arise and affect critical information infrastructure objects of Ukraine, are a highly specialized subject matter of research searches. Therefore, there is no clear identification of the term «risk» in the context of the proposed public relations at the scientific level. It has been emphasized that the legislative doctrine also does not define its content and essence.
 The general theoretical and legal definition of the term «risk» has been analyzed. An attempt to differentiate its characteristics as a distinct legal phenomenon from related legal categories has been made.
 It has been summarized that the category of risk in the context of ensuring safety and sustainability of critical information infrastructure in Ukraine is a is a form of manifestation of danger caused by the presence of phenomena, factors, circumstances, events, etc., which can potentially have negative consequences on the course of public relations, functionality of objects or specific legally protected interests in this sphere. In addition, we have clarified that the category of threat should also be understood as a form of manifestation of danger, which is due to the presence of phenomena, factors, circumstances, events, etc., but only those that will damage safety and sustainability of critical information infrastructure in Ukraine in the future (in particular, if it is not neutralized, it will become a risk).
 It has been summarized that to ensure that potential risks in the field of critical information infrastructure protection do not become an actual problem, the State, in formulating its policy in this area, should clearly define, i.e. establish at the legislative level what is a risk to critical infrastructure in general and for information one – in particular. This is necessary to develop clear methodologies for monitoring and forecasting certain risks in the future to avoid their negative effects.

AICrit: A Design-Enhanced Anomaly Detector and Its Performance Assessment in a Water Treatment Plant

Critical Infrastructure Security Showdown 2021—Online (CISS2021-OL) represented the fifth run of iTrust’s international technology assessment exercise. During this event, researchers and experts from the industry evaluated the performance of technologies designed to detect and mitigate real-time cyber-physical attacks launched against the operational iTrust testbeds and digital twins. Here, we summarize the performance of an anomaly detection mechanism, named AICrit, that was used during the exercise. AICrit utilizes the plant’s design to determine the models to be created using machine learning, and hence is referred to as a “design-enhanced” anomaly detector. The results of the validation in this large-scale exercise reveal that AICrit successfully detected 95.83% of the 27 launched attacks. Our analysis offers valuable insights into AICrit’s efficiency in detecting process anomalies in a water treatment plant under a continuous barrage of cyber-physical attacks.

AI and Blockchain-Based Secure Data Dissemination Architecture for IoT-Enabled Critical Infrastructure.

The Internet of Things (IoT) is the most abundant technology in the fields of manufacturing, automation, transportation, robotics, and agriculture, utilizing the IoT's sensors-sensing capability. It plays a vital role in digital transformation and smart revolutions in critical infrastructure environments. However, handling heterogeneous data from different IoT devices is challenging from the perspective of security and privacy issues. The attacker targets the sensor communication between two IoT devices to jeopardize the regular operations of IoT-based critical infrastructure. In this paper, we propose an artificial intelligence (AI) and blockchain-driven secure data dissemination architecture to deal with critical infrastructure security and privacy issues. First, we reduced dimensionality using principal component analysis (PCA) and explainable AI (XAI) approaches. Furthermore, we applied different AI classifiers such as random forest (RF), decision tree (DT), support vector machine (SVM), perceptron, and Gaussian Naive Bayes (GaussianNB) that classify the data, i.e., malicious or non-malicious. Furthermore, we employ an interplanetary file system (IPFS)-driven blockchain network that offers security to the non-malicious data. In addition, to strengthen the security of AI classifiers, we analyze data poisoning attacks on the dataset that manipulate sensitive data and mislead the classifier, resulting in inaccurate results from the classifiers. To overcome this issue, we provide an anomaly detection approach that identifies malicious instances and removes the poisoned data from the dataset. The proposed architecture is evaluated using performance evaluation metrics such as accuracy, precision, recall, F1 score, and receiver operating characteristic curve (ROC curve). The findings show that the RF classifier transcends other AI classifiers in terms of accuracy, i.e., 98.46%.

The impact of educational training on improving the vigilance of public officials against cyber-attacks

Cybersecurity today is a phenomenon of global and multidimensional proportions. Protecting against cyber-attacks is a challenge for governments and the private sector. Increasing the security and protection of data and critical infrastructure against cyber-attacks is one of the essential factors of an institution that manages confidential data. The authors first present the findings from the research conducted regarding the skills that public officials have on various risks from cyber-attacks. The authors then present the results from testing the skills of public officials through the simulation of two cyber-attacks and the method applied by one public institution in Kosovo (as case study for this research is used Ministry of Internal Affairs - MIA) to raise the awareness of its officials about the various risks of cyber-attacks. Also, this paper focuses on analyzing the results before and after increasing the skills of MIA officials against cyber-attacks, as well as giving concrete recommendations from the results and analyses made. The presented results show that the applied method for raising the awareness of public officials on the risks of cyber-attacks has given impressive results. The obtained results are supported by statistics obtained from the conducted tests.

Problems and Prospects of Implementing Assessment of the Level of Maturity of Cyber Security Processes of Critical Infrastructure Objects of the Energy Sector of Ukraine in Accordance with the NIST Cybersecurity Framework

Existing problems regarding compliance with requirements in the field of cyber security of Ukraine's critical infrastructure in the energy sector, prospects for the implementation of the NIST Cybersecurity Framework and ways to solve the identified problems are described. The Ukrainian legislative framework was analyzed and compared with European and American practices, and the issue of compliance with the requirements of the legislation of various jurisdictions was determined.

Cyberterrorism: content, forms and promising countermeasures

The purpose of the study is to clarify the concept of cyber terrorism, its typical features and main forms, and to develop proposals for improving the system of countermeasures. The article highlights modern approaches to defining the content of cyber terrorism and its social and legal nature. This type of terrorism should be regarded as a socially dangerous politically motivated activity aimed at disrupting the critical information infrastructure of the State and thus creating a danger to human life and health or causing other serious consequences, provided that such actions were committed for terrorist purposes, or using cyberspace for other purposes of terrorist activities not directly related to terrorist acts.
 Typical features of cyber terrorism are described and a definition of its concept is proposed. The main forms of cyber terrorism are revealed: the commission of terrorist acts by organisations, groups and individuals using computers and computer networks or by influencing the information processed (circulated) in them, as well as the use of cyberspace for other purposes of terrorist activities not directly related to the commission of terrorist acts.
 The counteraction system may be based on the following: proper regulation of the concept of cyber terrorism in national legislation, criminalisation of acts of cyber terrorism and its components; enhancing the security and protection of critical information infrastructure; improving existing and applying new counteraction methods; improving cooperation in the field of combating cyber terrorism.

Розвиток парадигми резильєнтності в домені безпеки

A review of scientific publications aimed at determining the basis for the formation of the resili-ence paradigm in the security sphere is provided. The main stages of the evolution of the resili-ence paradigm in the context of security are considered, including its origin, development and multifactorial impact on the security of critical systems and infrastructures at different levels. The definitions, concepts, and key ideas underlying the paradigm are examined in detail, high-lighting the fundamental principles that contributed to its emergence. Special attention is paid to the constructs underlying the resilience paradigm in the security domain. Emphasis is placed on their practical implementation in frameworks and international legislation.

Enhancing Security in Cyber-Physical Critical Infrastructures A Focus on Detecting Integrity Attacks through Ensemble Modeling

Improving the safety of cyber-physical key assets is very important to keep their processes safe from attacks on their stability. In this study, we suggest a new way to find these kinds of threats using ensemble modeling methods. Integrity attacks are a big problem for these systems because they can change or control important data, which can have very bad results. Because these threats are so complex, traditional security measures often fail to spot them. This shows how important it is to have more advanced monitoring systems. The suggested method uses ensemble modeling, which blends several machine learning techniques to make identification more accurate. Ensemble modeling has shown promise in a number of defense contexts, providing resilience against different types of attacks. Ensemble approaches are good at finding integrity attacks that single models might miss because they use a variety of models, each with its own pros and cons. The study also talks about how different datasets can be used to teach ensemble models so that they can find a lot of different attack patterns. The study also looks at how to improve the ensemble's ability to find small changes from normal behavior by adding anomaly detection methods like Isolation Forest and Support Vector Machines (SVM). In general, this paper gives a complete plan for using ensemble models to make cyber-physical key systems safer. The suggested method aims to make these systems more resistant to integrity threats by using a variety of datasets and monitoring techniques. This will make sure that they work reliably and securely.

Radar stations as a means of ensuring the security of critical information infrastructure

The paper systematizes the main characteristics of radar stations as a means of ensuring the security of critical information infrastructure. The main types of radar stations are analyzed. It is shown that the dominant type among radars are pulse radars of the centimeter and millimeter ranges, which use a single antenna, are quite simple and ergonomic when used for their intended purpose. The concepts of tactical and technical characteristics of radar stations are analyzed. The features of the main tactical characteristic - the range of the radar station are considered. It is shown that in order to determine the target detection range, taking into account the influence of environmental conditions and terrain (at the location of the radar station), it is necessary to use a system of equations containing the dependences of the detection ranges of energy, geometric, expected and actual (statistical). The correspondence of analytical calculations to actual results makes it possible to assess the reliability of assumptions about the reflecting properties of goals in various conditions of the situation while ensuring the security of critical information infrastructure.

Current issues of the safety of the hospital – as a critical infrastructure

Aim: To explore the current security issues of in-patient care institutions from the perspective of critical infrastructure protection activities.Methodology: Examination of EU and national regulations on critical infrastructure, analysis of the legislative environment applicable to hospitals in security areas, based on practical experience.Findings: The regulation of critical infrastructure protection in the European Union and in Hungary is constantly evolving, and the development of further regulation affecting hospital safety is showing a mixed picture. The new EU Directive, which aims to increase resilience, will allow the introduction of standard methodological approaches that will impact on the complex security level of the hospital through the security of the patient care process.Value: The static operational critical infrastructure security planning practice has evolved over the past seven years, but further development of the planning methodology is needed to enable the organization to respond dynamically to the fundamental challenges of the healthcare sector and its ever-changing environment. To this purpose, standardized planning practices are available, applied and used in production at international level.

The political-legal framework of the Republic of Moldova regarding the digitalization of public services

Moldova’s commitment to digital transformation has become increasingly clear and has accelerated both at the policy and implementation levels. In the context of the war in Ukraine, supporting and strengthening elements of the country’s digital system, such as cyber security of critical infrastructure, media literacy of citizens, and enabling environment for IT business become an imperative of the hour. Digital literacy is a clear priority of the policy of the Republic of Moldova. In order to secure services, but also in order to harmonize with the requirements and standards of the European Union (EU), the Government has introduced measures to implement some policies and strategies regarding the digitization of services. This was due to the presence of a fragmented cyber security system, a small number of cyber security cadres, but also due to weak government technical capacity. This article highlights the main actions undertaken by the country’s leadership in order to digitize public services. Also, this article highlights the gaps faced by the Republic of Moldova in the context of the digitalization of public services.

УСТОЙЧИВОСТЬ ТЕХНОЛОГИЧЕСКИХ ПРОЦЕССОВ В АСПЕКТЕ БЕЗОПАСНОСТИ КРИТИЧЕСКОЙ ИНФОРМАЦИОННОЙ ИНФРАСТРУКТУРЫ

The purpose of the paper is to study the sustainability of technological processes in the aspect of the security of critical information infrastructure (CII). Cybercrime today brings attackers an income (affecting critical information infrastructure objects) of about $1.5 trillion a year, which means that the security of critical information infrastructure is still requiring due attention. Currently, there is no generally accepted approach to conducting such an assessment and its definition remains an urgent problem. It is also important to understand that the stability of technological (including significant, critical) processes does not always ensure their safety (management safety), as well as ensuring safety does not ensure the execution of technological processes. The object of the study is the objects of the CII. The subject of the study is technological processes in the context of threats to information security. The technological process and its stability at CII facilities in the aspect of information security are studied. The analysis of regulatory legal acts (NPA) and scientific publications on the research topic is carried out. The analysis of the NPA of the CII showed that there are serious problems in this area. In order to formulate specific measures of sustainability of indicators, one can use the given sustainability matrix. The paper formulates the requirements for evaluation indicators. Based on the results of the study, it was found that the assessment of the stability of the functioning of objects can be implemented on real significant objects of the CII, while the stability coefficients of the elements can be detailed in more detail. Definitions and problems are considered, the main sources confirming the importance of the study are presented. The results of the study can be used when considering approaches to assessing the sustainability of technological processes in the context of CII safety.

Cyber threat intelligence for critical infrastructure security

SummaryCyber‐attacks are considered the most significant threat to organizations from different sectors, including critical infrastructure. Access to critical assets, including industrial control systems, and control over their usage is one of the security approaches implemented to protect those systems from unauthorized access. However, existing implementations do not support the enforcement of fine‐grained authorization policies and do not provide continuous control over data access. Furthermore, existing implementations of the access control paradigm require policy‐makers to perform a manual update of policies that do not consider information about potential or ongoing cyber attacks. In this work, we propose a framework that enables continuous control on the execution of access rights in the industrial domain. Furthermore, the framework relies on cyber incident information shared by trusted entities. This information is used for updating security policies in order to prevent possible incidents within the smart factory infrastructure. We also provide experimental results that show the operability and the efficiency of the proposed framework.

Multi-Agent System for Rogue Drone Interception

A multitude of applications based on unmanned aircraft vehicles (UAVs), in conjunction with the UAVs' diminishing costs and increasing capabilities, present a major threat to public safety as well as critical infrastructure security, leading to the need for versatile and robust counter-drone solutions. This work presents a novel multi-agent jamming system (MUAV-JS), where a group of cooperative autonomous agents employ various algorithms (detection, tracking, jamming, and self-localization) to counter unauthorized drone operations. The proposed system employs a joint wireless jamming and cooperative positioning framework to best track and intercept the moving rogue drone, utilizing a relative positioning system based on signals of opportunity in conjunction with inertial and vision measurements. Software-defined radio technology is incorporated on the pursuer agent to achieve rogue drone GPS disruption, while at the same time the autonomous agents cooperate to compute the location estimate of the pursuer agent. In the presence of jamming, to improve the wireless communication performance of the autonomous agents, a cellular communication architecture is also used as an additional channel for control and information exchange. For evaluation purposes, a prototype multi-agent system is designed, implemented, and tested in a real-world environment to demonstrate its enhanced localization and jamming performance, when compared to single-agent approaches.

The use of biometric technologies in ensuring critical infrastructure security: the context of protecting personal data

The use of biometric technologies in ensuring critical infrastructure security: the context of protecting personal data

Cyber security of critical infrastructure during cyber warfare

The concepts and characteristics of critical infrastructure are defined. The role and place of critical infrastructure in the structure of national security of Ukraine is highlighted. The factors that affect the security of critical infrastructure are detailed. The principles of state policy in the field of cyber security of critical infrastructure are outlined. The threats that affect the security of critical infrastructure in the conditions of cyber warfare have been identified. The expediency of conducting periodic reviews of the state of cyber security of critical infrastructure of strategic sectors of the economy is substantiated. The ways and directions of ensuring the safety of critical infrastructure at the state level have been determined. The list of sectoral objects of critical infrastructure is detailed and the sectoral cyber security requirements for such objects are defined. The system of measures aimed at strengthening the protection of critical infrastructure against cyberattacks by the Russian occupiers is summarized. The role and tasks of the domestic special service in the field of counter-intelligence protection of critical infrastructure are revealed. A fragmentary review of domestic legislation devoted to strengthening the protection of critical infrastructure was conducted. The directions of improvements of the domestic legislation in order tostrengthen the state of ensuring cyber security of critical infrastructure under the conditions of themartial law have been determined.

Information about computer handwriting: The challenges of finding a balance between individual liberty and state security

The present study is devoted to the introduction of biometric identification systems in law enforcement. The author pays special attention to the phenomenon of computer handwriting, examining in detail the constitutional and legal aspects of the use of knowledge about it. For this purpose a wide methodological apparatus is used: comparative-legal method, method of analogy, deduction, method of modelling and others. The Russian practice and potential for further development are compared with the experience of foreign countries both in the regulation of general issues of biometric personal data and in situations of legal regulation of computer handwriting data. The author investigates how to simultaneously solve the problems of detection and investigation of offences in which printed texts act as evidentiary materials, and at the same time preserve human rights to privacy, personal and family secrecy, anonymity on the Internet. It is noted that computer handwriting is a rather young phenomenon for legal science; there is still no in-depth study of it from the perspective of this field of knowledge. This paper is only a beginning in understanding the topic under consideration. It raises basic questions: whether it is permissible to use knowledge about computer handwriting, how it should be protected and where it should be stored, whether it is necessary to limit the existing commercial interest in its use. As a result, the author comes to the following conclusions: it is permissible and necessary to collect information on computer handwriting, as this will reduce infringements on the natural rights of man and citizen. For such collection it is necessary to use a centralised state system in which all the requirements for the security of critical information infrastructure are implemented. However, before such a system is put into operation, it is necessary to support commercial companies in relevant developments and oblige them to provide information about users' computer handwriting at the request of authorised persons.