Agentic AI: A Game-Changer in Cybersecurity Defense

Security1 design of mobile apps is very important, and it is also important that researchers consider and disseminate the continually changing requirements. For mobile application i.e. a software program that runs on a mobile phone, its design, development and management need to consider security impact. In particular, because of mobile app is running on online devices, cyber security defense is required. In this chapter, mobile app security is discussed from the initial planning and design stage to its maintenance after its launch.

The power information network is a significant part of national key information infrastructure, as well as the core promoting force to guarantee the strategic development of energy internet. Due to its correlative characteristics in industrial control network, the internet and IoT, superadd a large of nodes and data sensitivity, the evolving network attack technology has put forward new requirements and challenges to its security protection system, which also hinders the overall interconnecting and interworking of energy internet to a certain extent. In order to improve the network security capability of full-service power network under the energy internet environment, a power information security framework based on cloud service was proposed to improve the safety and reliability, build an end-to-end electronic authentication mechanism and security management mode of strong data interworking, finally realize the life cycle data protection, trusted identity management and reliable electronic voucher application, meet the rapid development of the energy internet and escort the new digital economic of the power industry.

There is a flurry of discussion, press and vendors explaining how helpful data science techniques can assist in cyber security defence; however, there is little information available about how to effectively leverage and implement data science techniques within a company’s cyber security defence team. The goal of this paper is to empower security incident response teams (SIRTs) to seamlessly build, deploy and operate ML solutions at scale. Our proposed solution is designed to cover the end-to-end ML workflows. Take-aways include managing and deploying a prediction pipeline, training data, prediction model evaluations and continuously monitoring these deployments to assist in SIRTs’ ability to defend and thwart cyber security attacks. An additional use case of implementing a machine learning (ML) application to predict domain-generating algorithms with the integrated data science pipeline and platform is also discussed and used as a reference.

In this study, the authors introduce ARCADES (Analysis of Risk from Cyberattack against DEfensive Strategy), a technique to systematically explore the cybersecurity defence strategies based on contingency rankings in power systems. While cybersecurity defensive standards exist, these approaches are primarily based on expert opinions, rather than systematic studies of risk. ARCADES presents an approach to identify improved cybersecurity defensive strategies based on a graph‐based cyber‐physical security model that is evaluated by resistance‐distance metrics and then prioritised based on contingency analysis studies of the system. This study also proposed a technique that identifies the most critical cybersecurity mechanisms to protect the power grid. Planning and operation: those two applications for cybersecurity on power grid mainly explored in this study. For planning, a systematic method is developed to verify the effectiveness of security strategies and for operation, prioritised the security mechanism for auditing and monitoring purpose. As a case study, they analyse the IEEE‐14 bus, IEEE‐30 bus, and IEEE‐118 bus systems, observe the defensive strategies, and calculate substation criticality ranking by using the authors’ proposed method.

UW CIAC’s inter-collegiate research team has extended the World of Work Inventory (WOWI) to four specific job roles that incorporate penetration testing: Cybersecurity Defense Analyst, Cybersecurity Defense Infrastructure Responder, Cybersecurity Incident Responder, and Vulnerability Assessment Analyst. Identification of these statistically validated profiles can support methodologically based recruitment of high prospective candidates from diverse backgrounds and can inform career guidance protocols for these roles. The WOWI is a statistically validated multi-dimensional career assessment tool. Training data is gathered from a sample of people currently working in the roles, and the instrument identifies profiles for predicting successful candidates across aptitude, personality types, and interests. For this research, we selected the four roles that utilize the task of penetration testing within the category Protect and Defend, in the NIST NICE 800-818 Cybersecurity Workforce Framework. [1] Penetration testing is a skill that is in high demand in career pathways within government, industry and the military.

Every firm big or small, regardless of the industry, operating capital, size, geographical coverage, aims at improving its cybersecurity and risk posture. These firms build on that strategy by investing in cybersecurity defense tools and processes. The cybersecurity defense industry is filled with various companies providing security tools that span across the information security domains like access management, physical controls, encryption etc. The choices are endless and it is challenging to decide especially if you are a smaller firm with limited budget to spend. Bigger firms can explore choices and eventually go ahead with a tool and implementation model , can revert back changes if they don’t like the results, however, that’s not the case for smaller firms, the choice has to be rational, beneficial in the long run and not expensive. Of all the information security domains, Access management is the most important domain and the one to secure first for any firm, it offers defense in depth.This articles dives into details about concepts like Access management, difference between Access management and Access control, Identity and access management, Zero trust which is an advanced and matured framework on similar lines. It also explains why it makes sense for smaller companies with limited budget to opt for these choices, rationale, benefits.

Civil aviation faces increased cybersecurity threats due to hyperconnectivity and the lack of standardized frameworks and cybersecurity defenses. Educating the civil aviation workforce is one method to enhance cyber defense against cyber-attacks. Educating the workforce will lead to initiatives and strategies to combat cyber-attacks. Private and public entities need to remain aggressive in developing cyber defense strategies to keep pace with the increasing vulnerabilities of hyperconnectivity. Areas that require immediate attention to safeguard against cybersecurity threats in civil aviation are: 1) Eliminating supply risks, 2) Upgrading legacy systems, 3) Mitigating technological aftereffects, 4) Increasing cybersecurity awareness, 5) Developing cybersecurity workforce, 6) Managing hyperconnectivity, and 7) Leveraging international entities. To safeguard civil aviation infrastructure from cybersecurity threats require assertive, coordinated, and effective strategies and capabilities to defend the network.

Recent research indicates that public and private organizations worldwide face cybersecurity breaches due to a need for more cybersecurity awareness among their employees. This study assesses the cybersecurity culture in different organizations across various sectors in Leon City, Mexico. For this purpose, an evaluation process was implemented, which involved anonymous online surveys among employees from multiple sectors, including service companies, wholesale trade businesses, manufacturing industries, construction companies, and retail trade establishments. The study took place in 2022 and achieved a response rate of 73.33% from employees across the participating organizations. The findings underscore the necessity of fostering a robust cybersecurity culture within Leon City organizations, which entails implementing ongoing security awareness training programs to empower employees with the knowledge and skills to mitigate cyber risks effectively. Analyzing the results reveals valuable insights regarding the countermeasures implemented by organizations in Leon City to strengthen their cybersecurity defenses and minimize the risk surface. These insights enhance cybersecurity strategies and fortify the overall security posture of organizations operating in Leon City.

Distributed denial of service (DDoS) attacks pose a significant security risk, particularly with the increasing reliance on cloud computing and information technology (IT). These attacks not only allow unauthorized users to access services but also deny legitimate users the ability to utilize them. Traditional antivirus solutions and firewalls prove insufficient in detecting DDoS attacks within large networks. Intrusion detection systems (IDS) are essential for detecting unauthorized or malicious activities and ensuring the confidentiality, integrity, and availability of services. However, traditional IDS often rely on predefined signatures and patterns, making them susceptible to evasion tactics. In response, this research introduces a deep learning (DL)-based IDS that integrates convolutional neural networks (CNN) with principal component analysis (PCA) and explores the application of vision transformers (ViT). The proposed hybrid model was tested on the CICDDoS2019 dataset, achieving a notable improvement in detection accuracy. Specifically, the CNN-based model initially identified DDoS attacks with an accuracy of 99.72%. Upon integrating ViT, the model’s accuracy further improved to 99.99%. This innovative approach signifies a considerable advancement in the detection capabilities for DDoS attacks and underscores the potential for integrating more sophisticated DL models into cybersecurity defenses.

The article analyzes the existing legal mechanisms for managing critical information infrastructure in Ukraine. The instruments for their improvement are proposing in this article. An important component of critical infrastructure is its information component – a critical information infrastructure. The sphere of protection of critical information infrastructure in Ukraine is at the initial stage of formation. The current legislation defines only certain objects of socio-economic sphere, in which extraordinary events can lead to socially dangerous consequences. In view of the fact, that the term “critical information infrastructure” does not having a consistent interpretation in different countries, we propose our opinion. “Critical information infrastructure is a system of information management of critical facilities and information and communication networks that provide defense capabilities and security of public and private institutions, whose operation may flow to the national security of Ukraine” (KII). In the KII we can identified information and network components. Information environment of KII is a system for information management of critical objects, including computing and information resources that form automated control systems (ACS). The network component of KII consists of a set of telecommunication devices, communication lines and network equipment, systems of open protocols for the exchange of information between elecommunication devices, global system of digital addresses and digital identifiers, software. The Internet network can be considered as a technological add-on over a telecommunication network that provides the provision of data transmission and processing services (e-mail, teleconferencing, file transfer, access to computing and information systems in local area networks). The main threat to the safety of ACS of critical information infrastructure objects is targeted actions on information systems, information and telecommunication networks by software and hardware. KII legal security include two main components – national and international. The national component may be forming by a set of principles, legal institutions and norms, which are enshrined in the national legislation regulating public relations in Ukraine in the area of counteracting the security threats of the ACS of critical objects. In order to protect the most important objects of KII, it is necessary to identify these objects. The current legislation defines such categories of objects, for which special conditions for ensuring their protection and functioning are established. Some of them, in whole or in part, may be classifying as objects of critical infrastructure. The specificity of providing information security was reflecting in such Ukraine laws like “On the Fundamentals of National Security of Ukraine”, “On the Concept of the National Program of Informatization”, “On the National Program of Informatization”. As well as the Concept of Development of the Security and Defense Sector of Ukraine, the National Security Strategy of Ukraine, the Strategy of Cybersecurity Of Ukraine. The National Security Strategy identifies actual threats to national security and sets priorities for information security, cyber security and security of information resources and critical infrastructure. At the same time, the implementation of the state policy in the field of security of KII requires the further development of legal principles and norms governing the relevant social relations, that is, the national component of the legal security of KII. Ukraine should ensure the establishment of a nationwide system for assessing risks and threats to critical infrastructure, and after the legislative definition of the main terms, the implementation of the Identification of Critical Information Infrastructure objects. Identification of objects of critical information infrastructure can be accomplishing by introducing the certification of objects of critical information infrastructure. Such passports must contain general data about the facility, data on the main sources of danger, data on hazardous natural conditions, technological processes and response to threats. The international component of the legal security of KII provides for the regulation of a set of principles and norms defined by international treaties and recognized by the state, regulating issues of international cooperation in this area. Ukraine has signed the Convention on Cybercrime together with the member states of the Council of Europe and other States. It is aiming at stopping actions against the confidentiality, integrity and availability of computer systems, networks and computer data, as well as abusing such systems, networks and data by installing the criminal responsibility for such behavior, the provision of powers sufficient to combat criminal offenses, and the conclusion of agreements on rapid and reliable international cooperation. In addition, the plan of measures for 2017 on implementation of the Cybersecurity Strategy of Ukraine provides for the implementation of Directive 2008/114/EC on the protection of critical infrastructure, in particular on cybersecurity and cyber defense of critical infrastructure objects. Development of the system of international information security, the following main groups of international relations that requirenormative legal regulation within the framework of the legal security of KII: definition of the boundaries of the national KII in the global information and communication infrastructure and fixing signs of computer incidents in the control system of critical objects information infrastructure. The absence of generally recognized borders of state sovereignty of States in this space is a significant obstacle to the application of international law to the actions of other states. In particular, this impedes the establishment of limits of responsibility of states for violating the security of the KII and organizing international cooperation in the field of countering computer crime. The urgency of the legislative consolidation of signs of computer incidents in the automated control system of critical information infrastructure objects suggests the widespread use of the concept of “incident” in international law. An incident in cyberspace usually associated with a violation of the functioning of the components of cyberspace – an electronic collection environment and automated processing of information that determines the processes of the implementation of these operations, as well as information systems and automated control systems. The essence of the general definition of the “international incident” in the field of KII will be determining, firstly, by the nature of international relations between states that are violating by the “incident”. This event may be the result of unforeseen actions of the state, including actions that harm the interests of public bodies of one or more states, or, conversely, be one of many intentional but minor provocations carried out by agents of one state against another state. Given that international relations in the field of incidents in the field of KII are not regulating by international treaties, the main and, in fact, the only source of international law in this case serves as an international custom, however, its application to the sphere of KII is accompanying by considerable difficulties. For Ukraine, it is possible to introduce the positive experience of other states in the security of the KII. In particular, the problem of security of information technologies has been enshrined in the international standard ISO / IEC 15408 “General criteria for assessing the safety of information technology”.

In today's cyber environment, modern botnets and malware are increasingly employing domain generation mechanisms to circumvent conventional detection solutions reliant on blacklisting or statistical methods for malicious domains. These outdated methods prove inadequate against algorithmically generated domain names, presenting significant challenges for cyber security. Domain Generation Algorithms (DGAs) have become essential tools for many malware families, allowing them to create numerous DGA domain names to establish communication with C&C servers. Consequently, detecting such malware has become a formidable task in cyber security. Traditional approaches to domain name detection rely heavily on manual feature engineering and statistical analysis, with classifiers designed to differentiate between legitimate and DGA domain names. In this study, we propose a novel approach to classify and detect algorithmically generated domain names. The deep learning architectures, including LSTM, RNN and GRU are trained and evaluated for their effectiveness in distinguishing between legitimate and malicious domain names. The performance of each model is evaluated using standard metrics such as precision, recall, and F1-score. The findings of this research have significant implications for cyber security defense strategies. Our experimental findings illustrate that the proposed model outperforms current state-of-the-art methods in both DGA domain name classification and detection. Our proposed model achieved 99% accuracy for DGA classification. By integrating additional feature extraction and knowledge-based methods our proposed model surpasses existing models. The experimental outcomes suggest that our proposed model gated recurrent unit can achieve 99% accuracy, a 94% recall rate, and a 98% F1-score for the detection and classification of DGA-generated domain names.

Historical assessments of combat fratricide reveal principal contributing factors in the effects of stress, degradation of skills due to continuous operations or sleep deprivation, poor situation awareness, and lack of training and discipline in offensive/defense response selection. While these problems are typically addressed in R&D focusing on traditional ground-based combat, there is also an emerging need for improving situation awareness and decision making on defensive/offensive response options in the cyber defense arena, where a mistaken response to an actual or perceived cyber attack could lead to destruction or compromise of friendly cyber assets. The purpose of this report is to examine cognitive factors that may affect cyber situation awareness and describe possible research needs to reduce the likelihood and effects of "friendly cyber fire" on cyber defenses, information infrastructures, and data. The approach is to examine concepts and methods that have been described in research applied to the more traditional problem of mitigating the occurrence of combat identification and fratricide. Application domains of interest include cyber security defense against external or internal (insider) threats.

Summary form only given. With the development of substation automation system, it is now feasible for the intelligent electronic devices (lEDs) based protection system to collect its measurements from electronic instrument transformers through communication network such as Ethernet based LAN. Application of wide area broadband network in power utilities introduces underlying danger for protection system to mal-operate when receiving fake data packages from intruder. This paper proposes to identify vicious fault using context information such as voltage and current of the same substation. When protection system detects fault based on measurements transmitted through network, it collects all measurements of the substation and feed these data to a Probabilistic Neural Network (PNN). Thereafter, the fault caused by fake data that differs from the known fault pattern can be identified and blocked.

Purpose Penetration tests have become a valuable tool in the cyber security defence strategy in terms of detecting vulnerabilities. Although penetration testing has traditionally focussed on technical aspects, the field has started to realise the importance of the human in the organisation, and the need to ensure that humans are resistant to cyberattacks. To achieve this, some organisations “pentest” their employees, testing their resilience and ability to detect and repel human-targeted attacks. In a previous paper, the authors reported on PoinTER (Prepare TEst Remediate), a human pentesting framework, tailored to the needs of SMEs. This paper aims to propose improvements to refine the framework. The improvements are based on a derived set of ethical principles that have been subjected to ethical scrutiny Design/methodology/approach The authors conducted a systematic literature review of academic research, a review of actual hacker techniques, industry recommendations and official body advice related to social engineering techniques. To meet the requirements to have an ethical human pentesting framework, the authors compiled a list of ethical principles from the research literature which they used to filter out techniques deemed unethical. Findings Drawing on social engineering techniques from academic research, reported by the hacker community, industry recommendations and official body advice and subjecting each technique to ethical inspection, using a comprehensive list of ethical principles, the authors propose the refined GDPR-compliant and privacy respecting PoinTER framework. The list of ethical principles, as suggested, could also inform ethical technical pentests. Originality/value Previous work has considered penetration testing humans, but few have produced a comprehensive framework such as PoinTER. PoinTER has been rigorously derived from multiple sources and ethically scrutinised through inspection, using a comprehensive list of ethical principles derived from the research literature.

Ransomware attacks cost businesses more than $75 billion/year, and it is predicted to cost $6 trillion/year by 2021. These numbers demonstrate the havoc produced by ransomware on a large number of sectors and urge security researches to tackle it. Several ransomware detection approaches have been proposed in the literature that interchange between static and dynamic analysis. Recently, ransomware attacks were shown to fingerprint the execution environment before they attack the system to counter dynamic analysis. In this paper, we exploit the behavior of contemporary ransomware to prevent its attack on real systems and thus avoid the loss of any data. We explore a set of ransomware-generated artifacts that are launched to sniff the surrounding. Furthermore, we design, develop, and evaluate an approach that monitors the behavior of a program by intercepting the called Windows APIs. Consequently, we determine in real-time if the program is trying to inspect its surrounding before the attack, and abort it immediately prior to the initiation of any malicious encryption or locking. Through empirical evaluations using real and recent ransomware samples, we study how ransomware and benign programs inspect the environment. Additionally, we demonstrate how to prevent ransomware with a low false positive rate. We make the developed approach available to the research community at large through GitHub to strongly promote cyber security defense operations and for wide-scale evaluations and enhancements.