This paper reviews the state of the art in cyber security risk assessment of Supervisory Control and Data Acquisition (SCADA) systems. We select and in-detail examine twenty-four risk assessment ...methods developed for or applied in the context of a SCADA system. We describe the essence of the methods and then analyse them in terms of aim; application domain; the stages of risk management addressed; key risk management concepts covered; impact measurement; sources of probabilistic data; evaluation and tool support. Based on the analysis, we suggest an intuitive scheme for the categorisation of cyber security risk assessment methods for SCADA systems. We also outline five research challenges facing the domain and point out the approaches that might be taken.
Small and medium-sized enterprises (SMEs) are among the least mature and most vulnerable in terms of their cybersecurity risk and resilience. In this article, we describe a methodology developed ...using the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework (CSF) as a starting point. The NIST CSF does not meet all the needs of the SME IT leader, but it offers a solid foundation for a useful evaluation and recommendation methodology. We propose an SME cybersecurity evaluation tool (CET) that consists of a 35-question online survey to be completed by IT leaders to self-rate their maturity within the five NIST framework categories: identify, protect, detect, respond, and recover. We outline this approach to cybersecurity risk management before discussing its effectiveness and implications for practitioners.
As the world strides into the digital world, cybersecurity has become an indispensable part of connected devices. Although we have developed cybersecurity measures that can effectively defend against ...malicious software, we don’t have an accurate solution against attacks like social engineering attack, scam calls or phishing. In this work, a novel detection system called m-isds(mobilized intrusion and spam detection system) architecture is proposed, borrowing ideas from the widely utilized advanced hybrid intrusion detection system(ids), combining with some novel concepts including machine learning, advanced hashing technologies and pattern-matching technologies that are secure and cryptographically safe to provide a solution to the proposed system with low false-positive rate and privacy infringement while remaining responsive and flexible against all types of attacks. The system aims to scan the content of the whole terminal on the fly, not only containing and defending against the threat of malicious softwares but also alerting the user of possible scams and spams, bringing the security goal of mobile devices to a whole new level.
This study delves into the interplay between personal dispositions and cybersecurity behaviors within organizational settings. It investigates how optimism bias influences attitudes toward ...cybersecurity and subsequently affects cybersecurity behavior. Additionally, it examines the moderating role of information security awareness in shaping the relationship between attitude and risky cybersecurity behavior.
Drawing upon extensive research on coping mechanisms and attitude-behavior consistency, we develop a research model that hypothesizes the dynamics of optimism bias, attitude toward cybersecurity, risky cybersecurity behavior, and information security awareness. Survey data are collected from non-IT employees across the United States, and the model is empirically validated using structural equation modeling (SEM).
This study finds that optimism bias directly contributes to risky cybersecurity behavior and fosters a negative attitude toward cybersecurity. It also reveals that a poor attitude toward cybersecurity further reinforces risky cybersecurity behavior. Additionally, information security awareness is found to negatively moderate the relationship between the attitude toward cybersecurity and risky cybersecurity behavior.
This study investigates optimism bias in the context of cybersecurity. It enhances the theoretical and empirical understanding of optimism bias in cybersecurity by revealing its influence on cybersecurity attitude and behavior in organizational settings. It also offers managerial insights into the importance of shaping non-IT employees’ cybersecurity attitudes and behavior through risk communication, cybersecurity education, and training.
Purpose
While data breaches are reported daily, organizations are struggling with quantifying their cybersecurity posture. This paper aims to introduce the Universal Cybersecurity Footprint Index ...(UCFI), an organizational measure of Cybersecurity Footprint. The UCFI helps organizations understand the challenges related to their overall cybersecurity posture and be able to assess it for their supply chain cybersecurity. The Theory of Cybersecurity Footprint states that the risk and damage that can be caused by an attacked organization are not related to the size of the organization but to a range of parameters that may affect the interconnected entities in their supply chain.
Design/methodology/approach
Based on the 26 elements found in prior research, a survey was conducted, using 27 subject matter experts to reveal the most relevant elements and then specify their importance level to calculate their relative weight.
Findings
Results indicated that 20 of the 26 elements were validated, and their weights were calculated. Finally, an equation representing the UCFI for an organization is introduced.
Practical implications
Organizations can choose their partners according to a minimum value of the UCFI to reduce their cybersecurity risks.
Social implications
Supply chain cybersecurity incidents have demonstrated in the past several years to provide a massive impact on society. Thus, further assisting in mitigation of cyberattacks to the supply chain is significant.
Originality/value
This research aims to provide further assistance for organizations in quantifying their cybersecurity footprint in effort to help reduce cyber incidents, especially those for small organizations.
•We examine whether a buyer’s strategic arrangement of establishing targeted cybersecurity requisites for its potential suppliers is effective and beneficial.•Requiring cybersecurity assurance might ...induce a supplier to engage in perfunctory activities.•The perfunctory activities are less likely if a supplier determines security effort without knowing the cybersecurity maturity level required by the buyer.•A buyer should impose more security breach responsibility on the supplier.
This study uses analytical models to investigate whether requiring cybersecurity assurance or a particular maturity level for vendors or contractors will help them improve their cybersecurity management. Our findings suggest that, if a supplier decides on its preferred cybersecurity maturity level without knowing what level a contract requires, the supplier is more likely to exert more effort to improve its cybersecurity management. We also show that a buyer can incentivize the supplier to engage in improving cybersecurity risk management by imposing a reduced contractual price or a fine when a breach occurs. Our findings reveal the role played by cybersecurity maturity level assurance and we discuss practical implications.
AI in Cybersecurity Market scheme helps organizations in observance, detecting, reporting, and countering cyber threats to keep up information confidentiality. The increasing awareness among folks, ...advancements in info technology, up-gradation of intelligence and police work solutions, and increasing volume of knowledge gathered from numerous sources have demanded the utilization of reliable and improved cybersecurity solutions all told industries. The increase in the incidence and quality of cyber-attacks is driving AI-enabled cyber systems. Increasing incidents of huge cyber-attacks globally have created awareness among organizations for securing their information. The motive behind these cyber-criminals are political competition, competitors move for gain and harming the name of others, international information theft, and radical non-secular cluster interest. Most cyber-attacks are for gain. In this review we have presented some previous studies related to Cybersecurity which involves AI.
This paper proposes new concepts for detecting and mitigating cyber attacks on substation automation systems by domain-based cyber-physical security solutions. The proposed methods form the basis of ...a distributed security domain layer that enables protection devices to collaboratively defend against cyber attacks at substations. The methods utilize protection coordination principles to cross check protection setting changes and can run real-time power system analysis to evaluate the impact of the control commands. The transient fault signature (TFS)-based cross-correlation coefficient algorithm has been proposed to detect the false sampled values data injection attack. The proposed functions were verified in a hardware-in-the-loop (HIL) simulation using commercial relays and a real-time digital simulator (RTDS). Various types of cyber intrusions are tested using this test bed to evaluate the consequences and impacts of cyber attacks to power grid as well as to validate the performance of the proposed research-grade cyber attack mitigation functions.
PDF
