Evaluating Deception Theories for Applicability to Cyber Operations

Our exploratory study considers whether the internal audit function is an efficient “third line of defense” for risk management and control as proposed by The Institute of Internal Auditors. To that end, we interview chief audit executives (CAEs) and experienced internal auditors to examine whether (and how) CAEs manage the impressions of audit committee members in the annual accountability process. We also provide an illustration of impression management techniques through a documentary case that explores a unique and exclusive dataset consisting of the main guidance, framework, and accountability documents of one of these organizations. Our analysis highlights how several macro- and microimpression management techniques were used to burnish the image of internal auditors and, more importantly, the management team. Rather than monitoring managers, the CAEs team up with them. Our findings cast doubts on the conceptualization of internal audit as the independent third line of defense envisioned to be a keystone of the governance mosaic. This study supports other research that questions the effectiveness of internal auditing as a governance mechanism. It also contributes to the impression management literature by exposing impression management practices that occur through a private reporting channel—the internal audit function’s annual accountability to the audit committee. Last but not least, significant ethical concerns are raised in regard to internal audit, and research is urged in that area.

Plants absorb light energy for photosynthesis via photosystem complexes in their chloroplasts. However, excess light can damage the photosystems and decrease photosynthetic output, thereby inhibiting plant growth and development. Plants have developed a series of light acclimation strategies that allow them to withstand high light. In the first line of defense against excess light, leaves and chloroplasts move away from the light and the plant accumulates compounds that filter and reflect the light. In the second line of defense, known as photoprotection, plants dissipate excess light energy through non-photochemical quenching, cyclic electron transport, photorespiration, and scavenging of excess reactive oxygen species. In the third line of defense, which occurs after photodamage, plants initiate a cycle of photosystem (mainly photosystem II) repair. In addition to being the site of photosynthesis, chloroplasts sense stress, especially light stress, and transduce the stress signal to the nucleus, where it modulates the expression of genes involved in the stress response. In this review, we discuss current progress in our understanding of the strategies and mechanisms employed by plants to withstand high light at the whole-plant, cellular, physiological, and molecular levels across the three lines of defense.

Wildfires pose a significant challenge to the natural and the built environments, as well as the safety and economic wellbeing of the communities residing in wildfire-prone areas. The electric power grid is specifically among the built environments most affected by, and contributing to, wildfires. In this paper, we propose a three lines of defense (3LD) framework for wildfire risk management in electric power infrastructure and review the literature from this lens. An overview of the physics and phenomenology of the wildfires as it relates to power grids is presented, and the logic for the proposed 3LD framework is discussed. The reviewed literature based on the 3LD theme includes the most relevant and emerging research work on wildfire prevention as the first line of defense, wildfire mitigation and proactive response as the second line of defense, and wildfire recovery preparedness as the third line of defense. This study reveals that while the state of the art, to a large extent, stands comprehensive in various aspects of power system resilience and wildfire risk management, there is a gap in the literature in addressing this emerging risk in a holistic, interdisciplinary approach.

As offensive cyber operations have become more commonplace, cyber collateral damage (CCD) to society and to civilian infrastructure has expanded in impact and severity. Several research contexts, frameworks, and methods apply to these collateral effects, especially as they pertain to reducing them. To investigate and map this area of research, five leading scientific databases (Scopus, IEEE Xplore, Springer Link, ScienceDirect, and ProQuest) were searched for papers on CCD. From 716 search results, 74 relevant papers were selected. Using surface categories as well as thematic analysis, these were grouped into the main emergent categories of legal, ethical, targeting-oriented, and econometric papers, with each category showing a recent research trend. The papers were qualitatively assessed for importance and coverage and compared bibliographically to identify key papers and authors. Within the identified areas of research, significant gaps remain. While CCD is becoming increasingly well understood from a legal and operational perspective, this accounts only for a fraction of the civilian harm caused by offensive cyber operations. This study identifies potential pathways for the synthesis of the current research areas (targeting, taxonomy, econometrics) with broader definitions of collateral damage to include civilian harm. These include updating national cyber doctrines to require collateral damage estimates, as well as exploiting emerging open datasets to understand which cyber capabilities cause the greatest collateral effects. Finally, we observe that the research definitions and taxonomy of CCD differ widely and have been subjected to limited scrutiny and challenge to date.

In the realm of contemporary warfare dominated by cyber threats, Defensive Cyber Operations (DCO) serve as a linchpin for mitigating risks and ensuring mission assurance. This article delves into the intricate landscape of DCO, focusing on the critical role played by Defensive Cyberspace Forces (DCFs). Despite their significance, the absence of a unified sensemaking framework poses a challenge for leaders responsible for the nuanced development and strategic employment of DCFs. The lacuna in the existing literature revolves around the lack of a comprehensive sensemaking framework tailored for operational and DCF leaders. The inadequacies of current frameworks, either overly broad or excessively specific, hinder effective dialogue and understanding. This deficiency not only obstructs the planning efforts and operational tempo of DCO but also restrains the maturation of DCFs, amplifying residual risks faced by commanders. This paper endeavours to present a purpose-built sensemaking framework crafted for leaders engaged in the dynamic realms of DCF development. Integrating well-established risk mitigation principles with the unique organizational structures and missions of DCFs, the framework fills a crucial void in the literature. Beyond being a decision-support tool, it strives to foster a shared mental model, providing a nuanced lens for leaders to contextualize and prioritize their efforts in the complex landscape of DCO. Through a meticulous critique of existing frameworks, this article introduces a tailored model designed to address identified shortcomings. Emphasizing the practical utility of the proposed framework, the discussion unfolds to elucidate how it not only facilitates the development and employment of DCF but also contributes to organizational resilience and risk mitigation. This article contributes a novel sensemaking framework to the academic discourse on DCO. While acknowledging limitations imposed by an unclassified context, the framework provides valuable insights into the strategic dimensions of DCF development and employment, DCO planning intricacies, and organizational analyses. Future avenues for research include the integration of classified information to refine the framework, ensuring its applicability across diverse DCO mission types and aligning DCF core functions with specific threats, thereby enhancing the efficacy of defensive cyber strategies.

Subject Vulnerability disclosure debates. Significance When intelligence agencies discover vulnerabilities in computer systems, they face a choice: either to make public their existence, which could allow them to be fixed and thus protect civilian end-users from cyberattack, or to conceal the knowledge and exploit the vulnerabilities for future intelligence and cyber operations. As the recent WannaCry ransomware attack shows, the decision is far from clear-cut. Impacts Large releases of vulnerabilities may hamper intelligence agencies in conducting intelligence gathering and offensive cyber operations. Technology firms will continue to argue for a large release of vulnerabilities, but the security benefits are mixed. Russia, China, Iran and North Korea enjoy an asymmetrical advantage, with their cyberagencies under less commerical pressure to disclose.

Cyber security is neither an offensive panacea nor the Pearl-Harbor-like vulnerability it is imagined to be. The conclusions review how it is uniquely difficult to create effects successfully, continuously and meaningfully through offensive cyber operations (OCOs) in a military context. They require immense investment, operational discipline, and access to immense amounts of accurate targeting intelligence. While many countries actively use--or plan to--OCOs, few do so very well. The United States is uniquely positioned to deliver both tactical and strategic effects alongside combat operations and beyond them, but is often hampered by the limitations of its own bureaucracy and shackling "cyber" within a domain of warfare. Russia is a prolific, aggressive and technically capable user of OCOs, but frequently makes operational errors which are costly in a high-accuracy medium such as OCOs. The Chinese People's Liberation Army invests significantly in creating capabilities suitable to its military aims but is as-of-yet untested in campaign-wide joint operations. Iran frequently punches above its weight in effects by creating low-complexity, noisy, but noticeable effects delivered through proxies and conventional forces.

The rapid increase in regulatory requirements in European banking supervision law has made internal audit more than ever, a third line of defense. In order to ensure a comprehensive control mechanism - also and in particular in banking groups - the auditors must have extensive access to all relevant business activities and processes. This is all the more true the more complex the structure and activities of a banking group are, especially among subordinate companies abroad. In the case of cross-border revisions in particular, the IA‘s inspection rights could diverge due to differing legal situations between the parent company and the subsidiary and, among other things, create problems for monitoring the consolidation. The present article concretely addresses the rights and obligations of the internal banking group audit and focuses on the inspection rights of this organizational unit in the course of its cross-border audit activities.

The Third Line of Defence

To address the challenge posed by the limited effectiveness of the conventional third line of defense in managing substantial power disturbances in low-inertia power systems, a frequency emergency control approach is introduced. This strategy is grounded on the power regulation capacity of a virtual power plant (VPP). Initially, a VPP physical model is formulated, encompassing distributed renewable energy sources, energy storage systems, and electric vehicles. To account for user behavior uncertainty, the emergency power regulation capability of the VPP is quantitatively articulated, considering both its regulation capacity and duration. Subsequently, real-time frequency monitoring is conducted on the power grid. In instances where the grid frequency falls below the predefined safety threshold of 49.2Hz, the energy storage system's charging and discharging status is evaluated. If the energy storage system's regulation capacity proves inadequate to meet the frequency requirements, the distributed energy sources and electric vehicles are dynamically prioritized based on the VPP control center's preferences. Active power allocation is then executed in accordance with the established priority sequence. Ultimately, numerical illustrations demonstrate that the proposed strategy efficiently harnesses the power regulation potential of the VPP. It enables swift responses to severe power deficits, leading to a notable reduction in low-frequency load shedding. Moreover, it enhances the frequency stability and operational reliability of the power grid.

Due to improving computational capacity of supercomputers, transmitting encrypted packets via one single network path is vulnerable to brute-force attacks. The versatile attackers secretly eavesdrop all the packets, classify packets into different streams, performs an exhaustive search for the decryption key, and extract sensitive personal information from the streams. However, new Internet Protocol (IP) brings great opportunities and challenges for preventing eavesdropping attacks. In this paper, we propose a Programming Protocol-independent Packet Processors (P4) based Network Immune Scheme (P4NIS) against the eavesdropping attacks. Specifically, P4NIS is equipped with three lines of defense to improve the network immunity. The first line is promiscuous forwarding by splitting all the traffic packets in different network paths disorderly. Complementally, the second line encrypts transmission port fields of the packets using diverse encryption algorithms. The encryption could distribute traffic packets from one stream into different streams, and disturb eavesdroppers to classify them correctly. Besides, P4NIS inherits the advantages from the existing encryption-based countermeasures which is the third line of defense. Using a paradigm of programmable data planes—P4, we implement P4NIS and evaluate its performances. Experimental results show that P4NIS can increase difficulties of eavesdropping significantly, and increase transmission throughput by 31.7% compared with state-of-the-art mechanisms.

Military networks rely today on federated systems with coalition or cooperation partners. Examples of this kind of military networks are the NATO lead ‘Federated Mission Networking’ (FMN) project and the US lead ‘Mission Partner Enterprise’ (MPE). The framework of FMN and MPE are very similar and the development of both frameworks goes hand-inhand. The development and understanding of cyber defense mechanism need to include the importance of the extra challenge that is brought by federating networks. In the attempt to counter the threat, federated networks should form groups of interest, where not only technical information is shared within the group for increased ability to counter intrusions, but also analyzed tactical and operational information and to certain extent intrusion method information. Not all militaries or nations are willing to share information on ‘how’ they protect their own networks, but as this paper shows, there is a need to share information on current events as well as events that have transpired. The aim of this paper is to present aspects what different participants in a federated or mission network should share and elaborate why this information needs to be shared. The key finding is a set of information categories that should be shared in a federated network. The paper will firstly present a generic overview of Responsive Cyber Defense, also known as Defensive Cyber Operations- Responsive actions in US terminology, and introduce previous findings regarding benefits of incident information sharing. The second part of the paper will examine different generic Responsive Cyber Defense situations in order to exemplify the new need for information sharing in a federated context. The paper concludes with recommendations and suggestions on issues to take into consideration when establishing a federated network, where Responsive Cyber Defense capabilities are incorporated.

The discussion critically evaluates the effectiveness of laws dealing with cyber threats within the context of the South African cybersecurity landscape. It deals with the legal response to non-state cyber operations to national security and law enforcement by means of the domestic law and not with state or state-sponsored cyber operations which falls within the remit of the international law. Globally the digital ecosystems of all countries face a common denominator, namely the threat of cyber operations and how to deal with it effectively. There are various cyber operations, but the discussion mainly deals with cyber operations that target the confidentiality, availability and integrity of information and the effectiveness of the South African cybersecurity legislation in protecting information. The effectiveness of the following legislation will be deliberated: • The Protection of Personal Information Act (POPIA) 4 of 2013. POPIA does not define a data breach, nor does it indicate the time in which the breach must be reported to the Information Regulator (IR). In 2021 the Department of Justice and Constitutional Development (Department) suffered a ransomware attack. The breach was reported to the IR. In July 2023 the Department became the first institution to be fined for failure to comply with an enforcement notice. • The Cybercrimes Act 119 of 2021. The ransomware attack suffered by the Department in 2021 constitutes a cybercrime, but how effective is the Cybercrimes Act to facilitate the investigation and prosecution of the threat actor(s) who orchestrated the attack? Should there not be guidelines in respect of a ransomware attack prescribing a compulsory reporting obligation or discouraging payment of ransom. The first line of defense to offensive non-state cyber operations is a robust and resilient cybersecurity legal framework. Although a government cannot eliminate all possible threats, it can mitigate the risks, and this can be achieved by means of a comprehensive cybersecurity strategy. A country should have a cybersecurity strategy and it will be determined if for example the 2023 United States of America cybersecurity strategy could serve as guidance to South Africa. Why is your paper of interest to the conference participants? Use this space to persuade the reviewers why they should select this abstract for the conference : In today’s digital world, one cannot ignore the importance of cybersecurity. One single security breach may result in the exposure of the personal information of millions of people. Cybersecurity legislation is therefore essential to ensure the protection of government departments, institutions, businesses and individuals against malicious cyber operations.

This article looks at the definition of cyber terrorism and terrorist use of the Internet. The article evaluates cyber terrorist threats facing countries such as the United States of America, the United Kingdom, India and South Africa. The article also examines measures introduced by the respective governments in these countries to counteract cyber terrorist threats. Finally, the article will propose a way forward to counteract such possible threats in the future. The face of terrorism is changing. The convergence of the physical and virtual worlds has resulted in the creation of a “new threat” called cyber terrorism. Cyber terrorism is one of the recognised cyber crimes. The absence of suitable legal frameworks to address cyber terrorism at national and regional levels, the lack of adequate safeguards, the lack of cyber security strategies and the pre-occupation of countries with internal factors have all contributed to the creation of an environment that can be easily infiltrated by cyber terrorists. The horrific events of 9/11 provided the impetus for many countries to introduce antiterrorist legislation. The United States of America, United Kingdom, India and South Africa have introduced legislation to address the threat of cyber terrorism.KEYWORDS: Cyber space, cyber terrorists, cyber crime, cyber terrorism, hacktivism; legislation, international legislation; anti-terrorist legislation, cyber security, computer networks, critical infrastructure; United States of America, United Kingdom, India, South Africa.

Cyber warfare is a hot topic. The problem is that precedents are few. At the same time nation-states are strongly developing their cyber capabilities, cyber and physical worlds are increasingly intertwining, the level of cyber capabilities are difficult to estimate and the playbook to use cyber operations stays pretty empty. Many have been waiting Russo-Ukrainian war to be the first real and full-fledged battlefield of cyber, and indeed there are many examples of how cyber operations have been used during this hybrid war. However, destructive cyber attacks have been missing. This paper presents the key trends in current cyber warfare development, and analyzes the role of cyber warfare in the Russo-Ukrainian hybrid war.