Traditional IT Research Articles

Analysis of ICS and SCADA Systems Attacks Using Honeypots

Supervisory control and data acquisition (SCADA) attacks have increased due to the digital transformation of many industrial control systems (ICS). Operational technology (OT) operators should use the defense-in-depth concept to secure their operations from cyber attacks and reduce the surface that can be attacked. Layers of security, such as firewalls, endpoint solutions, honeypots, etc., should be used to secure traditional IT systems. The three main goals of IT cybersecurity are confidentiality, integrity, and availability (CIA), but these three goals have different levels of importance in the operational technology (OT) industry. Availability comes before confidentiality and integrity because of the criticality of business in OT. One of the layers of security in both IT and OT is honeypots. SCADA honeypots are used as a layer of security to mitigate attacks, known attackers’ techniques, and network and system weaknesses that attackers may use, and to mitigate these vulnerabilities. In this paper, we use SCADA honeypots for early detection of potential malicious tampering within a SCADA device network, and to determine threats against ICS/SCADA networks. An analysis of SCADA honeypots gives us the ability to know which protocols are most commonly attacked, and attackers’ behaviors, locations, and goals. We use an ICS/SCADA honeypot called Conpot, which simulates real ICS/SCADA systems with some ICS protocols and ICS/SCADA PLCs.

Digital transformation ambidexterity and business performance

PurposeWhat distinguishes digital transformation from other traditional IT transformations is its involvement of the entire organization, rather than merely the IT department. Thus, instead of taking a perspective that is confined to the IT department, this paper studies the ambidextrous nature of digital transformation (DT) from the standpoint of the whole firm. The authors define DT ambidexterity as the capability to utilize digital technology to simultaneously improve the efficiency of existing businesses (DT exploitation) and to promote business growth (DT exploration).Design/methodology/approachUsing annual reports of Chinese firms as a mining material, this paper deploys text mining and word frequency analysis to develop a data set of digital transformation to construct DT exploitation, DT exploration and DT ambidexterity, so that the authors can examine and compare their impact on business performance.FindingsThis study's statistics show that observations in this research sample mainly manifest DT ambidexterity and DT exploitation, while DT exploration makes up the smallest proportion. The authors find that DT exploitation, DT exploration, and DT ambidexterity have positive, yet heterogeneous effects on business performance.Research limitations/implicationsThis study expands the existing literature of IT-related ambidexterity by examining the ambidextrous nature of DT from the angle of company-wide strategy instead of the perspective from IT-department and expands the extant literature of digital transformation by examining the heterogeneous effects of its different components on business performance. The authors also add to the digital strategizing literature by showing that different business strategy goals can be attained through different stages of DT.Originality/valueThis study expands the existing literature of IT-related ambidexterity by examining the ambidexterity nature of DT from the angle of company-wide strategy instead of the perspective from IT department and expands the extant literature of digital transformation by examining the heterogeneous effects of its different components on business performance. The authors also add to the digital strategizing literature by showing that different business strategy goals can be attained through different stages of DT.

Quantifying the Effects of Operational Technology or Industrial Control System based Cybersecurity Controls via CVSS Scoring

This paper has examined the application of the Common Vulnerability Scoring System applied to operational technology or industrial control system-based cybersecurity controls and demonstrated that the unique considerations and aspects of these environments are more accurately captured when compared against a traditional IT based evaluation. Multiple business drivers are compelling consumer goods manufacturers to augment and connect their manufacturing systems bringing with it increases in potential for experiencing a cybersecurity incident [1]. While other business verticals are able to utilize cybersecurity standards and control documents tailored for their industry, manufacturers do not have a set of materials that directly correlate to the operational technology environments in which their systems reside [2]. Cybersecurity practitioners face additional challenges in developing an understanding of the severity of the risks within these environments due to the lack of current quantifiable methods of evaluating the risks. The findings from this research provide cybersecurity practitioners with a repeatable and extensible method to derive the operational risk present to an organization due to the technologies and business strategies employed in the pursuit of business objectives.

A modular framework for auditing IoT devices and networks

In recent years, we have seen significant growth in the use of IoT devices as part of conventional enterprise networks to increase the operations, services, and functionality of business processes. The use of IoT technologies in businesses is expected to grow more in the coming years due to smart sensors, more computing power, and reliable mobile connectivity with 5 G capabilities. Since enterprise networks are liable to customers’ data and they generally have to follow certain compliances and regulations (e.g., PCI-DSS, HIPAA, etc.), they are always concerned about the overall security of their IT and security infrastructures. To address this concern, they have IT auditors that periodically analyse and assess different parts of IT infrastructure to ensure processes and systems run accurately and efficiently while remaining secure and meeting compliance regulations. Unfortunately, as of this writing, there is no customized or standalone standard that IT auditors can follow when they evaluate an IT infrastructure that has IoT devices installed. Since IoT devices have their own unique characteristics, it does not practical to use traditional IT auditing standards to audit IoT devices nor such practices can provide any meaningful audit results that can prevent corporations from violating their required compliances or regulations. This implies that if organizations want to take full advantage of IoT technologies for increasing profitability, they cannot rely on conventional IT auditing practices unless the auditors are equipped with a proper auditing framework tailored to audit IoT devices. Motivated by this, we present a modular IoT auditing framework to audit an enterprise network that consists of IoT devices. To support the implementation of the proposed framework, we provide a set of auditing questions covering all security-related features of IoT devices such as firmware, hardware, physical/logical security, communication, and data privacy.

Guest Editorial: Security of Communication Protocols in Industrial Control Systems (ICSs)

Over the past decade, the cyber security community has witnessed a trend in which advanced adversaries – such as nation-state actors and cybercriminal groups – are increasingly shifting their exploitation efforts from IT systems to OT and Industrial Control Systems (ICSs). This trend stems from the fact that a compromise of an ICS can have far greater consequences than that of a traditional IT system – potentially resulting not only in financial losses but also losses of human life and/or major environmental disasters.

Clustered federated learning architecture for network anomaly detection in large scale heterogeneous IoT networks

There is a growing trend of cyberattacks against Internet of Things (IoT) devices; moreover, the sophistication and motivation of those attacks is increasing. The vast scale of IoT, diverse hardware and software, and being typically placed in uncontrolled environments make traditional IT security mechanisms such as signature-based intrusion detection and prevention systems challenging to integrate. They also struggle to cope with the rapidly evolving IoT threat landscape due to long delays between the analysis and publication of the detection rules. Machine learning methods have shown faster response to emerging threats; however, model training architectures like cloud or edge computing face multiple drawbacks in IoT settings, including network overhead and data isolation arising from the large scale and heterogeneity that characterizes these networks.This work presents an architecture for training unsupervised models for network intrusion detection in large, distributed IoT and Industrial IoT (IIoT) deployments. We leverage Federated Learning (FL) to collaboratively train between peers and reduce isolation and network overhead problems. We build upon it to include an unsupervised device clustering algorithm fully integrated into the FL pipeline to address the heterogeneity issues that arise in FL settings. The architecture is implemented and evaluated using a testbed that includes various emulated IoT/IIoT devices and attackers interacting in a complex network topology comprising 100 emulated devices, 30 switches and 10 routers. The anomaly detection models are evaluated on real attacks performed by the testbed’s threat actors, including the entire Mirai malware lifecycle, an additional botnet based on the Merlin command and control server and other red-teaming tools performing scanning activities and multiple attacks targeting the emulated devices.

Business Modeling Innovation Using Artificial Intelligence Technology

Startups embracing artificial intelligence (AI) as a component of their business models are quickly emerging right now. The application of AI technology in business has been going on for a while, even though recent research reveals that new or alternative business models are being implemented.It might be claimed that AI technology has been used to business models for a very long time, which puts into question the uniqueness of these business models. In order to better understand how AI companies' business models may differ from traditional IT business models, this study compares them to each other. The first step is to create a taxonomy of business models for AI businesses using a sample of 162 Worldwide Stratup, from which four archetypal business models are derived: Deep technology researcher, data analytics supplier, AI product and service provider, and facilitator of AI development The following are three main elements of startup business models for AI firms that are discussed based on this descriptive analysis: (1) new value propositions made possible by AI, (2) Various uses of data to create value and (3) How AI technology affects general business reasoning. By defining their key purposes, common instantiations, and distinguishing features, this research adds to our fundamental understanding of the AI start-up business model. This study suggests intriguing directions for further investigation in the field of entrepreneurship. À It is structured to foster entrepreneurial activity. Taxonomies and models are actually instrument.

Business Modeling Innovation Using Artificial Intelligence Technology

Startups embracing artificial intelligence (AI) as a component of their business models are quickly emerging right now. The application of AI technology in business has been going on for a while, even though recent research reveals that new or alternative business models are being implemented.It might be claimed that AI technology has been used to business models for a very long time, which puts into question the uniqueness of these business models. In order to better understand how AI companies' business models may differ from traditional IT business models, this study compares them to each other. The first step is to create a taxonomy of business models for AI businesses using a sample of 162 Worldwide Stratup, from which four archetypal business models are derived: Deep technology researcher, data analytics supplier, AI product and service provider, and facilitator of AI development The following are three main elements of startup business models for AI firms that are discussed based on this descriptive analysis: (1) new value propositions made possible by AI, (2) Various uses of data to create value and (3) How AI technology affects general business reasoning. By defining their key purposes, common instantiations, and distinguishing features, this research adds to our fundamental understanding of the AI start-up business model. This study suggests intriguing directions for further investigation in the field of entrepreneurship. À It is structured to foster entrepreneurial activity. Taxonomies and models are actually instrument.

Users’ Perception Towards Cloud Computing: A Case of Department Statistic South Africa

This study was initiated as a result of the researcher’s concerns regarding computing infrastructure at the Department of statistic South Africa (Stats-SA). The concerns arise from issues observed on the physical infrastructure platform currently deployed within the organisation. It is therefore proposed to investigate the attitude and perceptions of users working in Stats-SA on cloud computing and their willingness to migrate from physical infrastructure to cloud. The issue of user behavior during the transition from traditional IT services to cloud services has been addressed in a lot of studies, but the perceptions of employees at Stats-SA have never been investigated. The study expounds on the technology acceptance model by incorporating factors such as availability, accessibility, security and reliability by investigating the perception of end-users. The investigation took the mixed research approach. A questionnaire was developed using three technology acceptance instruments: perceived ease of use, usefulness and attitude to measure the end-user’s intention to move to the cloud.

The importance of theory at the Information Systems Journal

The importance of theory at the <i>Information Systems Journal</i>

Models of threats to cloud services

Cloud services have become popular due to their advantages over traditional computing. The cloud provides remote access to software, hardware, and other services. This has allowed companies to be more productive and enabled remote work. Cloud services have fewer hardware and infrastructure requirements, which reduces the cost of maintaining and supporting information technology. The future success of organizations will depend, not least, on the extent to which they implement cloud computing in their operations. According to forecasts, spending on cloud IT technologies will continue to grow and in 2025 will exceed spending on traditional IT technologies. Security of cloud services is becoming a critical issue as more and more companies complete their digital transformation. Despite the many benefits, cloud services also face their own security threats and challenges. Since cloud services store and process a significant amount of sensitive information, a cloud breach can lead to data leaks that can hinder business development and cause significant damage to a company's reputation. There are risks associated with the unavailability of cloud services in case of technical problems and dependence on external providers. Therefore, companies should carefully assess potential threats and take appropriate measures to protect their data and business in general when using cloud services. There are many methods to help determine how prepared your organization is for the growing number of threats. Threat modeling is one of the methods for predicting and preparing for possible threats. Using modeling frameworks allows you to allocate resources and plan possible actions during an attack. There are many modeling frameworks available, but it is important to remember that these frameworks have their advantages and disadvantages, so the choice depends on the context and needs of a particular system. Analyzing, evaluating, and comparing existing methods for modeling and protecting against threats in cloud services is the main objective of this article.

A Machine Learning-Based Intrusion Detection System for IoT Electric Vehicle Charging Stations (EVCSs)

The demand for electric vehicles (EVs) is growing rapidly. This requires an ecosystem that meets the user’s needs while preserving security. The rich data obtained from electric vehicle stations are powered by the Internet of Things (IoT) ecosystem. This is achieved through us of electric vehicle charging station management systems (EVCSMSs). However, the risks associated with cyber-attacks on IoT systems are also increasing at the same pace. To help in finding malicious traffic, intrusion detection systems (IDSs) play a vital role in traditional IT systems. This paper proposes a classifier algorithm for detecting malicious traffic in the IoT environment using machine learning. The proposed system uses a real IoT dataset derived from real IoT traffic. Multiple classifying algorithms are evaluated. Results were obtained on both binary and multiclass traffic models. Using the proposed algorithm in the IoT-based IDS engine that serves electric vehicle charging stations will bring stability and eliminate a substantial number of cyberattacks that may disturb day-to-day life activities.

Towards accurate and automatic emergency department workflow characterization using a real-time locating system

ABSTRACT This paper presents how patient throughput within an Emergency Department (ED) can be accurately and automatically characterized using a combination of data derived from a real-time location system (RTLS) and other traditional hospital IT systems such as Electronic Medical Records (EMR) and Laboratory Information Systems. Such insights can be used by a hospital to identify bottlenecks or inefficiencies and develop strategies to optimize and monitor patient flows. A descriptive, retrospective study was conducted among 1149 patients. Five KPIs, including time from arrival to triageand total length of stay, were used to evaluate ED timestamps to characterize the flow of the patient. A description of the techniques used to combine the various data sources to perform the accurate measurements is provided. The paper also describes the measurements obtained and indicates how real-time locating systems can contribute towards improving the quality of the timestamps generated compared to only using data from traditional hospital IT systems. A principial finding is that there is a large gap between the length of stay using only EMR data and the one computed combining EMR and RTLS data. Finally, the paper provides guidelines on how to deploy such a system effectively.

Intelligent detection of IT assets in power grid enterprises based on signal processing and cyberspace

Signal processing can complete the processing of various types of signals to obtain key data. Signal processing can also filter out redundant noise signals and ensure the quality of source signals. Due to the various functions of signal processing technology, it is widely used in network security, especially in IT asset detection and other aspects. Cyberspace is a general concept, which represents all devices associated with network connections. Detecting network assets in cyberspace means finding all networked devices. The detection of IT assets for power grid enterprises can help power grid enterprise IT administrators understand enterprise IT assets. At the same time, it can also discover the security loopholes existing in the operation of the current enterprise IT assets, and use the detection results to fix the loopholes as soon as possible to prevent the occurrence of network security incidents. This paper firstly sorts out the concepts of signal processing, cyberspace and power grid IT assets, then combines CNN and signal processing technology to design an intelligent detection strategy for power grid IT assets, and compares the designed strategy with the efficiency and other indicators of traditional detection methods. In contrast, finally, a cyberspace-based IT asset intelligent detection strategy was designed, and a power grid enterprise IT asset intelligent detection system was designed. Through the deployment strategy test environment, a test case was written in Python language, and the cyberspace-based IT asset intelligent detection was found. Compared with the traditional power grid enterprise IT asset detection scheme, the strategy has better performance in all aspects. The research adopts the method of modeling and analysis to calculate the signal values of the IT assets involved as much as possible, thereby greatly reducing the possible errors in the evaluation of enterprise IT assets. The test of the results obtained by the formula shows that the IT asset detection combined with the cyberspace search method shows superiority in different indicators.

Transforming Health Insurance Claims Adjudication with Blockchain-based Solutions

Over the past decade, the blockchain technology has gained a significant traction with the introduction of the “bitcoin”, the first cryptocurrency back in 2008. The rapid growth of “bitcoin” as a currency and the Bitcoin as a protocol has served as a wake-up call to the IT community which began to realize the real potential of blockchain technology. Blockchain technology is capable of filling many gaps that traditional IT solutions struggle to address. In the other hand the increasing complexity of adjudicating health insurance claims is an urge to introduce more secure and efficient claims adjudication system. Blockchain technology has the potential to reshape the claims adjudication process not only due to its decentralized and tamper-proof features but to its consensus protocols and much more other characteristics. This article studies some of the most recent researches on blockchain solution for health insurance claim adjudication, evaluates the its feasibility and identifies areas where blockchain technology could be applied to improve efficiency and accuracy. This study will also examine the potential benefits and challenges of implementing a blockchain-based system, like reducing administrative costs and improving fraud detection.

Unpacking task-technology fit to explore the business value of big data analytics

Understanding how the application of big data analytics (BDA) generates business value is a persistent challenge in information systems (IS) research. Improving understanding of how BDA realizes business value requires unpacking theories to study the phenomenon. This study unpacks the task-technology fit (TTF) theory toward generating new and improved insights into the business value of BDA. Extant studies on TTF have mainly focused on traditional IT which is different from digital technologies like BDA that are malleable and dynamic. While TTF has primarily focused on how the technology meets task requirements, this study contends that tasks can also be structured to fit the functionality of technology. This study proposes a 2 × 2 matrix framework to explain how BDA and tasks interact. The framework indicates how the reconfigurability of tasks and the editability of BDA impact the fit between tasks and BDA. Future research should explore how the fit between tasks and BDA changes over time.

Implementation of a Continuous Integration and Deployment Pipeline for Containerized Applications in Amazon Web Services Using Jenkins

Today, cloud computing is the preferred option for the majority of businesses. DevOps techniques have been developed as a result, requiring developers to collaborate closely with network engineers to ensure the quick and secure deployment of their applications. Many organizations adopt DevOps and Continuous Integration and Continuous Deployment (CI/CD) techniques to address the slow delivery of services to customers as in Traditional IT approaches, which better meets customer needs. Thanks to the high flexibility and scalability of the infrastructure in the Cloud, DevOps, which unifies developers and operations teams, can bridge the gap between them. Automation is a representation of the CI/CD central approach. This does away with the requirement for human checks, but it does not come without security risk.

The emerging world of digital exploration services

This research draws on two global surveys of customers of IT services to identify an emerging IT space we call “Digital Exploration” services. In contrast with Traditional IT services and cloud-based Digital Exploitation services, Digital Exploration services involve conceiving and implementing new business strategies and processes using new digital technologies (e.g., blockchain, augmented reality, deep learning, IoT). In a follow-on study involving depth interviews with IT customers, the research identifies several factors critical to successful Digital Exploration. These include customer selectivity, close collaboration between IT providers and customers, strategic and systemic thinking, an open innovation approach, and use of performance directionality (versus precise KPIs). In addition, the depth interviews help identify specific changes needed in the mindsets and behaviors of business unit leaders and various functions in IT providers and customers for the promise of Digital Exploration services to be realized.

Artificial Intelligence Operating Model: A Proposal Framework for AI Operationalization and Deployment

At the heart of the newenterprise, across all activities, is a decision factory governed by some kindof intelligence. Among the great promises of Artificial Intelligence (AI) isits ability to lead to a significant evolution in the amount of data received,processed, or generates by companies, particularly those with a digitalconnotation. To bring about dramatic changes, AI does not need to be sciencefiction but simply a new way of approaching computerization subjects whether interms of design, development, or terms of expected results. It should be notedthat traditional IT solutions present a form of AI called - Weak AI - while theAI that is the subject of much noise, hype, and promises of transformation andpotential for growth is called - Strong AI -. This article aims to present, ina didactic way, a model called D2MO (For Data Ops, ML Ops, Model Ops, and AIOps) allowing the company to operationalize, in a structured approach, AIsubjects, activities, and projects. We target through this article to provideboth IT and business experts with a new framework offering a perfectarticulation between the different bricks and actors entering into thecomposition of an AI-based system thus allowing them to operate in harmony andan agile mode while taking advantage of this technology.

How Hard Is Cyber-risk Management in IT/OT Systems?A Theory to Classify and Conquer Hardness of Insuring ICSs

Third-party residual cyber-risk management (RCRM) services (e.g., insurance, re-insurance) are getting increasingly popular (currently, a multi-billion-dollar annual market) with C-suites managing industrial control systems (ICSs) based upon IoT-driven cyber-physical IT and OT technology. Apart from mitigating and diversifying losses from (major) cyber-threats RCRM services positively contribute to improved cyber-security as an added societal benefit. However, it is also well known that RCRM markets (RCRM for ICSs being a mere subset) are relatively nascent and sparse. There is a huge (approximately 10-fold) supply-demand gap in an environment where (a) annual cyber-losses range in trillions of USD, and (b) CRM markets (residual or otherwise) are annually worth only up to 0.25 trillion USD. The main reason for this wide gap is the age-old information asymmetry (IA) bottleneck between the demand and supply sides of the third-party RCRM market, which is significantly amplified in modern cyber-space settings. This setting primarily comprises interdependent and intra-networked ICSs (and/or traditional IT systems) from diverse application sectors inter-networked with each other in a service supply-chain environment.In this article, we are the first to prove that optimal cyber-risk diversification (integral to RCRM) under IA is computationally intractable, i.e., NP-hard, for such (systemic) inter-networked societies.Here, the term “optimal diversification” implies the best way a residual and profit-minded cyber-risk manager can form a portfolio of client coverage contracts. We follow this up with the design and analysis of a computational policy that alleviates this intractability challenge for the social good. Here, the social good can be ensured through denser RCRM markets that in principle improve cyber-security. Our work formally establishes (a) the reason why it has been very difficult in practice (without suitable policy intervention) to densify IA-affected RCRM markets despite their high demand in modern CPS/ICS/IoT societies; and (b) the efficacy of our computational policy to mitigate IA issues between the supply and demand sides of an RCRM market in such societies.