Cybersecurity Risk Assessments within Critical Infrastructure Social Networks

With the recent spate of high-profile data breaches, security-conscious organizations realize that their financial viability and business continuity depend on effective IT security risk management. Given the potential fallout of a breach, many organizations rely on vulnerability and compliance management initiatives to keep their critical information secure, protect sensitive systems, and demonstrate compliance with regulatory requirements. These efforts are further complicated by burgeoning new security exposures introduced by a proliferation of applications, employee-owned devices, mobile computing, social networks, and other expanding attack surfaces. As well, critical compliance regulations, such as PCI, HIPAA, and Sarbanes-Oxley, also mandate specific security controls pertaining to vulnerability management. Unfortunately, there’s no way around the harsh reality that noncompliance results in penalties, lost business, and other indirect costs. Additionally, aligning internal security processes with regulations and providing meaningful reports to management and auditors are notoriously time-consuming and costly exercises.

The article considers main methods to use intelligent techniques and algorithms, synthesized on their basis, as well as examinesdata presentation of network monitoring for IT security risk management of secure multiservice networks. The mathematical model of intelligent data presentation is developed and examined for IT security risk investigation and assessment.

This paper considers the implications of network effects and distinction of security measures in the risk management procedure. We compare three models in the risk management procedure: without network effects and general protection measures, without network effects but with general protection, and with both network effects and general protection measures. The paper details the impact in terms of security risks, investment levels, and benefits of security investment, in the three models. We show that the preferable way to conduct risk management procedure is to follow the latter of the three models.KeywordsNetwork EffectSecurity MeasureRisk MitigationSecurity RiskSuccessive AttackThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

GRC is an umbrella acronym covering the three disciplines of governance, risk management and compliance.In this context, IT GRC is the subset of GRC dealing with IT aspects of GRC.The main challenge of GRC is to have an approach as integrated as possible of the three domains.The objective of our paper is to study one facet of IT GRC: the links and integration between IT governance and risk management that we consider today as the least integrated.To do so, the method followed in this paper is first a systematic literature review, in order to identify the existing research works in this field.The resulting contribution of the paper is a set of recommendations established for practitioners and for researchers on how better deal with the integration between IT governance and risk management.It is then complemented by an analysis of ISO related standards, representative of industrial practices.

The threat of cyber-attacks and wireless communication technologies are now affecting a number of private and public organizations around the world. It is a challenge to protect today's data from cyber-attacks since it is highly dependent on electronic technology. It is possible to mitigate or reduce these risks by identifying them. Risk assessments can help to develop a plan for responding to and recovering from a cyber attack. It is crucial to continuously monitor and assess the risk environment to identify any changes in the organization's context and to keep track of the entire risk management process. Researchers from all around the world have proposed a number of methods to thwart cyber-attacks or minimize the harm they do. The aim of this chapter is to present in-depth analysis of the typical improvements achieved in the field of cyber security risk assessment and management and examines the impact of artificial intelligence and machine learning in cyber security risk assessment, and management.

Digitalization forces manufacturing companies to shift towards customer-oriented, highly data-driven forms of value creation. This results in a changing IT security risk landscape as data becomes an attractive target for adversaries leading to an increasing number of attacks. In order to successfully protect data, it is essential that it is assessed in an integrated manner. Although IT security and data-based value creation have been studied by large research bodies, the existing literature fails to provide guidance on IT security risk analysis in data-based value chains. To contribute to the closure of this research gap, we propose a modeling approach which allocates different data types to value activities and analyses the data types in relation to the properties of relevant IT security risks. The evaluation, conducted with industry experts, reveals that it is not only a company’s primary assets that are of concern but also less important data types subject to significant levels of exposure that bear considerable IT security risks.

Today, the implementation of measures for cybersecurity of information and communication systems and critical infrastructure of the state, countering and responding to computer incidents and cyber influences - remains one of the major tasks in the field of information security and cybersecurity of the state. Defining the directions of Ukraine᾿s foreign policy in the field of cybersecurity, the Strategy establishes that Ukraine will intensify its participation and partnership in international processes of standardization and certification in the field of cybersecurity, increase its “presence” in international, regional and other standardization bodies and institutes and certification of this area in the geopolitical sense. Based on the need for scientific substantiation of the institutional framework for the development of cybersecurity, special attention should be paid to the development of standards in the field of new IT technologies (including artificial intelligence, cloud databases, quantum computing and communications) and basic Internet architecture. The review of the problem field of research shows that in general the Internet should be comprehensive and open, the technologies supported and used in it should be focused on the person, his basic freedoms, guarantee neutrality to his privacy, ensure his privacy in cyberspace, and any restrictions should be carried out only in accordance with laws and regulations (standards). Ukraine᾿s position is that the use of certain technological processes should be legal and safe, in accordance with existing ethical standards. Current laws and regulations of the state, current national standards, including those developed and implemented, have been formulated taking into account promising areas of development of mechanisms for institutional support of cyber security and based on Euro-Atlantic experience. This allowed them to be implemented quite effectively in the regulatory framework of Ukraine. Nevertheless, during the analysis and generalization of theoretical approaches to the essence and content of some definitions, experts came to the appropriate legal conflict, namely that national standards contain requirements in partially similar areas of Ukrainian society, only with other names, such as: “information security”, “information technology security”, and “cybersecurity”. Thus, the author considers in detail the theoretical and practical significance of the draft Law of Ukraine “On Amendments to Some Laws of Ukraine on Standardization in the Areas of Cryptographic and Technical Protection of Information, Cyber Security, Counteraction to Technical Intelligence” at the initiative of MPs Fedienko O.P., Klochko A. and others, registration number 6568 of “28” January 2022 (first reading). Therefore, based on the implemented Cyber Security Strategy, which entered into force on 28.08.2021 and it is obvious that in the process of achieving its goals requires a systematic approach, the issue of legislation and standardization in cyber security and defining a specific subject of standardization in this area is extremely important.

Cyber security is the most critical aspect nowadays of our technologically based lives. Government institutions, banking sectors, public and private services, nuclear power plants, power grid operators, water suppliers or waste water treatment companies use information technologies in their day-to-day operations. Everything that uses technologies are based on communication and information systems and that means that it depends on cyber security. The public and private sector each year spend millions of dollars on technologies, security software and hardware devices that will increase the cyber security inside their companies, but they are still vulnerable. The main problem of this situation is that cyber security is still usually treated as a technical aspect or technology which can be easily implemented inside the organization and this implementation will guarantee cyber security. This attitude must change, because cyber security nowadays is something more than just the technology. This article presents the taxonomy of the critical infrastructure attacks, analyzes attack vectors and attack methods used to damage critical infrastructure as well as the most common cyber security mistakes which organizations make in the cyber security field when trying to make themselves safer from vulnerabilities. The main aim of this article is to provide theoretical aspects of the cyber security management model which can be used to ensure security of critical infrastructure in an organization or company. The cyber security management model that is presented in this article is analyzed from management perspectives and is not concerned with technological aspects and products that are used to protect critical infrastructure from cyber security attacks and vulnerabilities.

The article analyzes the existing legal mechanisms for managing critical information infrastructure in Ukraine. The instruments for their improvement are proposing in this article. An important component of critical infrastructure is its information component – a critical information infrastructure. The sphere of protection of critical information infrastructure in Ukraine is at the initial stage of formation. The current legislation defines only certain objects of socio-economic sphere, in which extraordinary events can lead to socially dangerous consequences. In view of the fact, that the term “critical information infrastructure” does not having a consistent interpretation in different countries, we propose our opinion. “Critical information infrastructure is a system of information management of critical facilities and information and communication networks that provide defense capabilities and security of public and private institutions, whose operation may flow to the national security of Ukraine” (KII). In the KII we can identified information and network components. Information environment of KII is a system for information management of critical objects, including computing and information resources that form automated control systems (ACS). The network component of KII consists of a set of telecommunication devices, communication lines and network equipment, systems of open protocols for the exchange of information between elecommunication devices, global system of digital addresses and digital identifiers, software. The Internet network can be considered as a technological add-on over a telecommunication network that provides the provision of data transmission and processing services (e-mail, teleconferencing, file transfer, access to computing and information systems in local area networks). The main threat to the safety of ACS of critical information infrastructure objects is targeted actions on information systems, information and telecommunication networks by software and hardware. KII legal security include two main components – national and international. The national component may be forming by a set of principles, legal institutions and norms, which are enshrined in the national legislation regulating public relations in Ukraine in the area of counteracting the security threats of the ACS of critical objects. In order to protect the most important objects of KII, it is necessary to identify these objects. The current legislation defines such categories of objects, for which special conditions for ensuring their protection and functioning are established. Some of them, in whole or in part, may be classifying as objects of critical infrastructure. The specificity of providing information security was reflecting in such Ukraine laws like “On the Fundamentals of National Security of Ukraine”, “On the Concept of the National Program of Informatization”, “On the National Program of Informatization”. As well as the Concept of Development of the Security and Defense Sector of Ukraine, the National Security Strategy of Ukraine, the Strategy of Cybersecurity Of Ukraine. The National Security Strategy identifies actual threats to national security and sets priorities for information security, cyber security and security of information resources and critical infrastructure. At the same time, the implementation of the state policy in the field of security of KII requires the further development of legal principles and norms governing the relevant social relations, that is, the national component of the legal security of KII. Ukraine should ensure the establishment of a nationwide system for assessing risks and threats to critical infrastructure, and after the legislative definition of the main terms, the implementation of the Identification of Critical Information Infrastructure objects. Identification of objects of critical information infrastructure can be accomplishing by introducing the certification of objects of critical information infrastructure. Such passports must contain general data about the facility, data on the main sources of danger, data on hazardous natural conditions, technological processes and response to threats. The international component of the legal security of KII provides for the regulation of a set of principles and norms defined by international treaties and recognized by the state, regulating issues of international cooperation in this area. Ukraine has signed the Convention on Cybercrime together with the member states of the Council of Europe and other States. It is aiming at stopping actions against the confidentiality, integrity and availability of computer systems, networks and computer data, as well as abusing such systems, networks and data by installing the criminal responsibility for such behavior, the provision of powers sufficient to combat criminal offenses, and the conclusion of agreements on rapid and reliable international cooperation. In addition, the plan of measures for 2017 on implementation of the Cybersecurity Strategy of Ukraine provides for the implementation of Directive 2008/114/EC on the protection of critical infrastructure, in particular on cybersecurity and cyber defense of critical infrastructure objects. Development of the system of international information security, the following main groups of international relations that requirenormative legal regulation within the framework of the legal security of KII: definition of the boundaries of the national KII in the global information and communication infrastructure and fixing signs of computer incidents in the control system of critical objects information infrastructure. The absence of generally recognized borders of state sovereignty of States in this space is a significant obstacle to the application of international law to the actions of other states. In particular, this impedes the establishment of limits of responsibility of states for violating the security of the KII and organizing international cooperation in the field of countering computer crime. The urgency of the legislative consolidation of signs of computer incidents in the automated control system of critical information infrastructure objects suggests the widespread use of the concept of “incident” in international law. An incident in cyberspace usually associated with a violation of the functioning of the components of cyberspace – an electronic collection environment and automated processing of information that determines the processes of the implementation of these operations, as well as information systems and automated control systems. The essence of the general definition of the “international incident” in the field of KII will be determining, firstly, by the nature of international relations between states that are violating by the “incident”. This event may be the result of unforeseen actions of the state, including actions that harm the interests of public bodies of one or more states, or, conversely, be one of many intentional but minor provocations carried out by agents of one state against another state. Given that international relations in the field of incidents in the field of KII are not regulating by international treaties, the main and, in fact, the only source of international law in this case serves as an international custom, however, its application to the sphere of KII is accompanying by considerable difficulties. For Ukraine, it is possible to introduce the positive experience of other states in the security of the KII. In particular, the problem of security of information technologies has been enshrined in the international standard ISO / IEC 15408 “General criteria for assessing the safety of information technology”.

The article is devoted to the study of the Italian cybersecurity architecture, the strategy and organizational principles of protecting the country’s critical infrastructure, and the logic of technical, legal, and institutional innovations in the field of cyber defense of the Italian Republic. It has been established that Italy took its first regulatory steps on cybersecurity relatively late compared to other European countries – in 2013 (‘Monti Decree’). The second Italian cybersecurity strategy (‘Gentiloni Decree’) aimed to streamline the institutional cybersecurity ecosystem in accordance with the requirements of the European ‘Network and Information Security (NIS) Directive’. An analysis of the evolution of Italian cybersecurity suggests that between the 2013 and 2018 strategies, most of the changes concerned the institutional framework (reduction of the number of actors with overlapping functions; centralization of the structure) rather than the formulation of cybersecurity policy. In accordance with the ‘NIS Directive’, a national team was established to respond to computer incidents (‘Computer Security Incident Response Team’, CSIRT). It was noted that the further development of a consistent and comprehensive legal framework in the field of cybersecurity was facilitated by the creation of the so-called ‘national cybersecurity perimeter’ (‘Perimetro di Sicurezza Nazionale Cibernetica’). Lawmakers have clearly defined ‘critical technologies’: artificial intelligence, robotics, semiconductors, cybersecurity, aerospace, defense, energy storage, quantum, nuclear, nano- and bio-technologies. It was noted that in recent years, Italy has strengthened its cyber defense capabilities by creating the National Cyber Security Agency (ACN), which was tasked with implementing the new (third) National Cyber Security Strategy for 2022–2026. The authors believe that the wide range of measures provided for by Italian legislation largely complies with the cybersecurity requirements developed by EU institutions. It is concluded that flexible national legislation based on government decrees avoids excessive regulatory framework, as it can be amended easily and relatively quickly.

In the field of information and cybersecurity, one of the most important and critical challenges is the human factor, because no software or technical tool can fully compensate for the lack of awareness of information and cyber risks, appropriate behavior and a responsible attitude to information protection. The introduction of cognitive science theories into the field of cyber security will increase the level of effectiveness of protection strategies. Cognitive modeling contributes to the creation of mathematical models that simulate the processes of human thinking, decision-making and behavior, which brings the transition from reactive protection to a proactive approach. This article is devoted to the study of the implementation of the cognitive approach in security systems. Based on the analysis of scientific literature, the main definitions of cognitive science are highlighted, in particular, the concepts of cognitive modeling, cognitive analysis and synthesis, types of cognitive models, fuzzy cognitive map. The advantages of cognitive theories in various sectors of society are outlined. It has been proven that cognitive modeling can be applied in the field of cybersecurity to understand and predict the behavior of both attackers and protective systems. The following cognitive models in cyber systems are described: symbolic modeling (rule-based modeling) is used to build intrusion detection systems (IDS) that analyze network traffic for known attacks; network modeling (modeling using neural networks) includes anomaly detection systems that analyze typical network behavior; Bayesian models (probabilistic modeling) help predict risks and the probability of a successful attack on a specific system; agent-based modeling is used to simulate cyberattacks and test the resilience of systems. It was determined that the use of hybrid models that combine the above is effective. The challenges of implementing cognitive modeling in the security field are highlighted. These are the difficulties associated with the need for large volumes of qualitative data on the behavior of attackers, the complexity of modeling human behavior, and ethical issues. The results of the study can be used as educational material for students of the specialty F5 Cybersecurity and Information Protection.

Startup companies and originated small businesses are an essential aspect of our nation’s economy, contributing to many organizations that aim, in some cases, to become larger enterprises. As a small business is in the mode of sustaining and growth, minimizing cybersecurity and business resilience threats may not be front and center on the minds of these entities. This paper will provide a case study background about a project and effort – the New Jersey Cybersecurity Regional Cluster (NJCRC) - that has contributed significant outreach to New Jersey small businesses to provide free cybersecurity risk assessments to help small businesses prepare their organizations against technical, operational, and cyber and information security resilience threats. In addition to the background of this outreach activity, the process and procedures followed, along with the selected cybersecurity risk assessment framework, a theoretical model followed, challenges, and learned lessons are demonstrated.

The modern realities of the digital transformation of society make it critically important to ensure cybersecurity as a key element of the state's national security. Ukraine, in conditions of permanent confrontation with hybrid threats and active digitalization of state and private structures, is faced with the need to form an effective system of legal regulation in the field of cyber defense. This study is aimed at a comprehensive analysis of the current state of legislative support for cybersecurity in Ukraine and identifying priority areas for its improvement. The relevance of the study is due to the rapid development of information and communication technologies, the increase in the number and sophistication of cyber attacks, as well as the need to adapt national legislation to European cybersecurity standards. The analysis of modern cyber threats demonstrates their cross-border nature, a high degree of coordination and the use of advanced technologies to cause damage to critical infrastructure, state institutions and the private sector. Special attention is paid to the study of the specifics of cyberterrorism, information operations and attacks on critical infrastructure in the context of modern geopolitical challenges. The methodological basis of the study includes a comprehensive approach to the analysis of regulatory legal acts, international agreements and the practice of their implementation into national legislation. The methods of comparative law, system analysis and empirical methods of research into the practice of law enforcement in the field of cybersecurity were used. Special attention is paid to the study of the experience of the European Union countries in the field of legal regulation of cyber protection and the possibilities of its adaptation to Ukrainian realities. The results of the study indicate the presence of significant gaps in the current legislation of Ukraine on the regulation of cybersecurity, including insufficient coordination between various state bodies, the absence of clear mechanisms for responding to cyber incidents and the inadequacy of sanctions for cyber offenses. Problems in the field of personal data protection, ensuring the security of critical information infrastructure and international cooperation in the field of countering cybercrime were identified. It was established that the existing regulatory framework does not fully meet the modern challenges of the digital age and requires comprehensive reform. The practical significance of the study lies in the development of specific recommendations for improving the legislative regulation of cybersecurity in Ukraine, including proposals for creating an integrated system of cyber protection, improving mechanisms for interagency interaction and increasing the effectiveness of countering cyber threats. Models of legal regulation adapted to the specifics of the Ukrainian legal system and compatible with international cybersecurity standards are proposed. Prospects for further research are related to the need for constant monitoring of the evolution of cyber threats and the appropriate adaptation of the legislative framework, the development of mechanisms for public-private partnership in the field of cybersecurity, as well as an in-depth study of the impact of artificial intelligence and new technologies on the system of legal regulation of cyber defense. An important direction is also the study of the role of international cooperation in the formation of the global cybersecurity architecture and the place of Ukraine in this system.

Hospitals are indispensable institutions for public healthcare and part of society’s critical infrastructures. The increasing use of information technology and networks creates new dependencies and risks that could affect medical service availability. A systematic analysis of risks associated with IT will help to determine the risks for critical processes caused by IT disruptions or failures.

In today’s digital world, cybersecurity has become one of the most pressing issues, as the growing number of connected devices has led to an increase in cyber threats that pose a serious risk to national and international security. In this context, cooperation between countries becomes extremely important to protect sovereignty and ensure cybersecurity at the global level. Ukraine, which has extensive experience in countering cyber threats, is actively involved in international initiatives and cooperation in this area. The article is devoted to the analysis of international cooperation in the field of cybersecurity and Ukraine’s role in this process. The study reveals the importance of an effective regulatory framework, in particular the Bug Bounty program and the vulnerability detection mechanism. Ukraine actively cooperates with international partners, which facilitates the exchange of experience and strengthening of cybersecurity. International cooperation with organizations that recognize security as one of their main goals, such as NATO and the European Union, is also of key importance. It is noted that Ukraine, being an active participant in international initiatives and having extensive experience in the field of cybersecurity, continues to play an important role in strengthening global cybersecurity and contributes to the creation of a safer cyberspace for all countries. In the process of ensuring cybersecurity, Ukraine is developing and implementing new programs and strategies, such as Bug Bounty, to help identify and eliminate vulnerabilities in information systems. In addition, an important step is the adoption of the Vulnerability Search and Identification Procedure, which allows business owners and government agencies to request permission to search for weaknesses in their systems. These initiatives allow Ukraine to actively participate in international cybersecurity processes and contribute to improving overall Internet security.