Identifying Critical Infrastructure in a World with Network Cybersecurity Risk

Cybersecurity vulnerabilities of cardiac implantable electronic devices: Communication strategies for clinicians—Proceedings of the Heart Rhythm Society's Leadership Summit

As teenagers increasingly engage with digital technology, cybersecurity vulnerabilities present significant risks to their online safety and privacy. Adolescents who lack awareness of secure online practices are particularly vulnerable to malicious actors seeking to exploit them. This paper is an empirical study investigating the relationship between real-world online behavior of teenagers, cybersecurity risks, and device interactions. The primary data set used for this analysis is teenage online behavior and cybersecurity risks. First, we consider demographic information: age, education, time spent online. We correlate this with online behaviors: use of a VPN, type of equipment (computer, mobile), use of public internet, engagement with risky websites. Finally, we analyze the data set using a combination of demographic and behavioral patterns to search for high-risk, negative outcomes. For our research, we analyze teenage online behavior patterns to identify key risk factors, develop predictive models for cybersecurity vulnerabilities, and produce actionable visualizations that illustrate the relationship between digital literacy and online safety. Our findings utilize data and business analytics to provide evidence-based recommendations for parents, educators, and policymakers to enhance teenage cybersecurity awareness and protective strategies.

Developing security systems to protect the storage systems are needed. The main objective of this paper is to study the security of file storage server of an organization. Different kinds of security threats and a number of security techniques used to protect information will be examined. Thus, in this paper, an assessment plan for evaluating cyber security of local storage systems in organizations is proposed. The assessment model is based on the idea of cyber security domains and risk matrix. The proposed assessment model has been implemented on two prestigious and important organizations in the Kingdom of Bahrain. Storage systems of the assessed organizations found to have cyber security risks of different scales. This conclusion gives certainty to the fact that organizations are not capable of following the cyber security evolution and secure their storage systems from cyber security vulnerabilities and breaches. Organizations with local storage systems can improve the cyber security of their storage systems by applying certain techniques.

This paper provides a novel and practical approach, to check the correctness and completeness of functional specifications (the completeness means complete for one specified function), especially for complex safety critical systems. This approach combines Artificial Intelligence (AI) planning technique, together with formal functional specification, to assist further cybersecurity vulnerability analysis on safety critical Industrial Control System (ICS). The effectiveness of this combination is represented by examples, which are based on a safety critical ICS-Refueling Machine (RM). RMs are widely used in Nuclear Power Plants (NPPs). The outcome of this idea is a correct and complete functional specification of specific functions, which is the key foundation for our further safety and security vulnerability analysis, especially for performing analysis based on model checking. This practical checking approach is applicable to further Instrumentation & Control (I&C) systems and platforms.

Purpose: This study aims to examine cybersecurity vulnerabilities in Indonesia’s digital public service transformation using a data-driven public policy perspective and to generate evidence-based policy recommendations. Research Methodology: This study applies a qualitative data science approach by combining systematic policy review with social media analytics. Public discourse on cybersecurity incidents was collected from Platform X through data scraping and analyzed using Orange software for sentiment analysis, keyword mapping, and temporal visualization to assess public perception and governance-related risks. Results: The analysis reveals a dominance of negative sentiment associated with public distrust, institutional dissatisfaction, and concerns over recurring data leaks. Data patterns indicate three systemic drivers of cybersecurity vulnerability: delayed implementation of derivative regulations under the Personal Data Protection Law, technical fragility and centralized risk exposure within the National Data Center, and uneven digital literacy across the population. The findings demonstrate that cybersecurity failures are not isolated technical incidents but reflect broader governance and policy implementation gaps. Conclusions: This study concludes that Indonesia’s digital transformation agenda is constrained by insufficient data-driven cybersecurity governance. The absence of integrated regulatory, technical, and social interventions weakens the state’s capacity to manage digital risks effectively. Limitations: This study is limited to publicly available social media data and does not include direct institutional or field-level validation. Contributions: This research contributes to data science for public policy by demonstrating how social media analytics can support policy diagnosis, risk assessment, and evidence-based cybersecurity reform in digital government systems.

The purpose of this study is to conduct a thorough analysis of the concept of port resilience, analysing organisational effects and technology contributions. The research utilises a multifaceted methodology, commencing with a Scopus search and a bibliographic co-occurrence analysis of authors’ keywords. A systematic literature review is subsequently undertaken utilising the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) methodology. Content analysis is utilised to examine two distinct research questions concerning different facets of port resilience. The study finds a transition in port resilience emphasis from infrastructure to a more holistic strategy that includes organisational, technical, and environmental aspects. Essential elements that enhance port resilience comprise adaptive capacity, efficient governance, and stakeholder collaboration. The study emphasises the vital importance of technology in bolstering resilience, while simultaneously acknowledging inherent hazards, such as cybersecurity vulnerabilities, system failures, and increased technological dependencies. The research offers significant insights to port managers and policymakers in formulating robust resilience policies, such as multi-stakeholder governance, cybersecurity protocols, and climate adaptation measures. The work enhances our understanding of port resilience and its ties to broader supply chain dynamics, contributing to the expanding knowledge in maritime logistics and operations management. Key findings reveal that effective port resilience requires collaborative governance models with active stakeholder participation, integration of advanced technologies like digital twins and IoT systems, balanced against cybersecurity risks, and adaptive organisational structures that can shift between centralised and decentralised approaches based on crisis demands.

Cyber-physical systems tightly integrate physical processes and information and communication technologies. As today's critical infrastructures, e.g., the power grid or water distribution networks, are complex cyber-physical systems, ensuring their safety and security becomes of paramount importance. Traditional safety analysis methods, such as HAZOP, are ill-suited to assess these systems. Furthermore, cybersecurity vulnerabilities are often not considered critical, because their effects on the physical processes are not fully understood. In this work, we present STPA-SafeSec, a novel analysis methodology for both safety and security. Its results show the dependencies between cybersecurity vulnerabilities and system safety. Using this information, the most effective mitigation strategies to ensure safety and security of the system can be readily identified. We apply STPA-SafeSec to a use case in the power grid domain, and highlight its benefits.

Industrial control systems (ICS) form the basis of critical infrastructures, managing complex processes in various sectors of industry, energy, etc. With the increasing frequency and complexity of cyber threats, effective management of ICS cybersecurity risks is critical. This paper is devoted to the analysis of approaches used in the field of cybersecurity risk management of automated process control systems. The study examines the cybersecurity risks of ICS and the role of international standards in managing cybersecurity risks. The results of the analysis carried out in this paper can serve as information for the development of new reliable cybersecurity risk management systems for ICS.

Cyber security is the most critical aspect nowadays of our technologically based lives. Government institutions, banking sectors, public and private services, nuclear power plants, power grid operators, water suppliers or waste water treatment companies use information technologies in their day-to-day operations. Everything that uses technologies are based on communication and information systems and that means that it depends on cyber security. The public and private sector each year spend millions of dollars on technologies, security software and hardware devices that will increase the cyber security inside their companies, but they are still vulnerable. The main problem of this situation is that cyber security is still usually treated as a technical aspect or technology which can be easily implemented inside the organization and this implementation will guarantee cyber security. This attitude must change, because cyber security nowadays is something more than just the technology. This article presents the taxonomy of the critical infrastructure attacks, analyzes attack vectors and attack methods used to damage critical infrastructure as well as the most common cyber security mistakes which organizations make in the cyber security field when trying to make themselves safer from vulnerabilities. The main aim of this article is to provide theoretical aspects of the cyber security management model which can be used to ensure security of critical infrastructure in an organization or company. The cyber security management model that is presented in this article is analyzed from management perspectives and is not concerned with technological aspects and products that are used to protect critical infrastructure from cyber security attacks and vulnerabilities.

Nearly all global economic trade flows through the ports and a broader intermodal transit system in which supporting technology networks are often privately owned and operated. The majority of government oversight and industry cooperation focuses on physical access and the safe construction and operation of ships. The cybersecurity of critical maritime and interconnected infrastructure remains largely unregulated with minimal, if any, assessment or mitigation of cybersecurity risks. These critical infrastructure networks encompass industrial control, SCADA, and information technology systems — much of it proprietary and dependent on operational support or interdependencies in intersecting domains, from energy to transportation. While many operators of the infrastructure are concerned about cybersecurity, the complexity of their systems, interdependence with other sectors, and an outsized public interest in mitigating cyber risks against such crucial economic arteries demonstrates a compelling need for standardized frameworks for assessing cybersecurity risk in the maritime domain. Our work identifies cyber risk factors affecting maritime infrastructure, present barriers to mitigating risks, and proposes the creation of an independent public/private entity for assessing, containing, and mitigating potential risks.

Power systems are increasingly incorporating sophisticated digital technologies, automation, and connectivity as digital transformation accelerates across critical infrastructure. This convergence with IT systems has brought up some new cybersecurity issues. It's important to note that the security needs of electrical systems are different from those of regular corporate IT networks. Digitization solutions for power systems establish a smart and connected network that connects digital tools, physical power facilities, and resources to generate digital economies. Traditional air-gapped power plants have been rapidly exposed to cyber risks and attacks because of digitization. Consequently, numerous organizations have been compelled to reassess their cybersecurity policies and standards before implementing advanced digital devices to improve their operations. Unlike cybersecurity solutions created for IT systems, the cybersecurity needs of power systems and their related industrial control systems necessitate a new approach, a different methodology, and design process. These attributes exacerbate the severity of the cybersecurity risk associated with these systems. The integration of smart devices and sensors into the infrastructure establishes vulnerable entry points into the systems. The communication mechanisms between each deployed smart meter are susceptible to a denial of service (DoS) or distributed denial of service (DDoS) attack. A single compromised sensor or meter has the capacity to cascade through the electrical.

In today’s modern digitizing manufacturing landscape, new and emerging technologies can shape how an organization can compete, while others will view this as a necessity to survive as manufacturing has been identified as a critical infrastructure. Universities struggle to hire university professors that are adequately trained or willing to enter academia due to competitive salary offers in the industry. Meanwhile, the demand for fields such as Artificial Intelligence, data science, and cybersecurity continuously rises with no foreseeable drop in demand in the next several years. This results in organizations deploying technologies with an inadequate staff that understands what new cybersecurity risks they are introducing into the company. Examined are how organizations can potentially mitigate some of the risk associated with integrating these new technologies and developing their workforce to be better prepared for looming changes in technological skill need. With the over a 10 % growth in organizations deploying Artificial Intelligence, the current cybersecurity workforce needs are over half a million. A struggle to find a viable workforce this research paper aims to serve as a guide for Information Technology managers and senior management to foresee the cybersecurity risks that will result from the incorporation of these new technological advances into the organization.

Today cyberattacks continue to evolve and are highly complex. They are also very expensive by the average cost of a breach-in cyberattack. The top ten most common cyberattack intrusion incidents for industrial, public, and private organizations are phishing attacks, negligent and malicious insiders, advanced persistent threats, zero day attacks, denial of service attacks, software vulnerabilities, social engineering attacks, and brute force attacks. Therefore, cybersecurity becomes an essential issue that generally focuses on the measures to protect valuable data, information, and business assets from malicious threat events that affect confidentiality, integrity, and availability of information. In this regard, it is vitally important that computer systems, networks and network-connected devices, infrastructure resources, and others stay up-to-date with current software operating systems, patches, and releases. Therefore, organizations need to institute policies and procedures that enforce the way their user’s access information and interact with network or system resources. Here the NIST Cybersecurity Framework and the MITRE Cybersecurity Criteria come into play. The NIST Cybersecurity Framework is a set of best practices, standards, and recommendations that support organizations to improve their cybersecurity measures. It focusses on using business drivers to guide cybersecurity activities and considering cybersecurity risks as part of the organizations cybersecurity risk management. In this regard, the framework provides a common organizing structure for multiple cybersecurity approaches by assembling standards, guidelines, and practices that are working effectively today. The MITRE Cybersecurity Criteria enable a collective response against cybersecurity threat events, worked out in conjunction with industry and government authorities. It describes the common tactics, techniques, and procedures of advanced persistent threats against organizations’ computer systems and networks and was later expanded to industrial control systems. In this regard, the MITRE Cybersecurity Criteria are fully committed to defending and securing cyber-ecosystems. NIST’s and MITRE’s goal is to develop cyber resiliency approaches and controls to mitigate malicious cyberattacks. Cyber resiliency enables anticipating, withstanding, recovering from and adapting to adverse conditions, stresses, cyberattacks, or compromises on computer systems, networks, infrastructure resources, and others. Against this background, this chapter introduces in Sect. 5.1 the NIST Cybersecurity Framework (NIST CSF) with their manifold possible uses and their great impact improving industrial, public, and private organizations’ cybersecurity needs. Therefore, Sect. 5.1 introduces the process of cybersecurity risk management. Since NIST CSF is one of the most relevant cybersecurity frameworks, Sect. 5.1 introduces the NIST Cybersecurity Framework. Section 5.1.1 introduces CIS Critical Security Controls, Sect. 5.1.2 ISA/IEC 62443 Cybersecurity Standard, Sect. 5.1.3 MITRE Adversarial Tactics, Techniques, and Common Knowledge, Sect. 5.1.4 NIST 800-653, and in Sect. 5.1.5, the NIST Cybersecurity Framework. Section 5.2 focuses on the NIST Cybersecurity Framework for Critical Infrastructure and focuses in Sect. 5.2.1 on a NIST CSF Critical Infrastructure best practice use case, making use of a model approach in cybersecurity maturity. Against this background, Sect. 5.3 focusses on the MITRE Cybersecurity Criteria that provides a common taxonomy of Tactics, Techniques, and Procedures, applicable to defend cyberattacks, to withstand cyberattackers activities like unauthorized interaction with organizations’ computer systems, networks, and infrastructure resources, to recover from potential malicious cyberattacks. Section 5.4 introduce the MITRE Cybersecurity Taxonomy, which refers to cyberattack possibilities and how to conquer them. Section 5.5 contains comprehensive questions on the topics of NIST Cybersecurity Framework and MITRE Cybersecurity Criteria. Finally, “References” refers to the used references for further reading.

Cyber security is the most important part of our technologically dependent lives today. Government institutions, financial firms, public and private services, nuclear power stations, power grid providers, water supplies or wastewater disposal corporations use information technology in their day-to-day activities. Anything that uses technology is focused on connectivity and computer networks, which ensures that it relies on cyber security. Every year, the public and private sectors spend millions of dollars on technology, protection tools and hardware that can improve cyber security within their businesses, but are still vulnerable. The key problem with this situation is that data defense is now generally viewed as a technological component or technology that can be quickly introduced within the enterprise, and this application would ensure cyber protection. This mentality needs to change, because cyber security is more than mere technology nowadays. This post presents the taxonomy of critical infrastructure threats, analyses attack vectors and attack tactics used to destroy critical infrastructure, as well as the most frequent cyber security failures that companies create in the area of cyber security while attempting to make themselves safer from vulnerabilities. The main purpose of this article is to include technical elements of the cyber security management model that can be used to ensure the protection of sensitive infrastructure in an enterprise or business. The network protection management model discussed in this article is examined from a management viewpoint and does not discuss the technical issues and products used to secure sensitive infrastructure from cyber security threats and vulnerabilities.

Vulnerabilities in cyber defense in the countries of the Latin American region have favored the activities of cybercriminals from different parts of the world who have carried out a growing number of cyberattacks that affect public and private services and compromise the integrity of users and organizations. This article describes the most representative vulnerabilities related to cyberattacks that have affected different sectors of countries in the Latin American region. A systematic review of repositories and the scientific literature was conducted, considering journal articles, conference proceedings, and reports from official bodies and leading brands of cybersecurity systems. The cybersecurity vulnerabilities identified in the countries of the Latin American region are low cybersecurity awareness, lack of standards and regulations, use of outdated software, security gaps in critical infrastructure, and lack of training and professional specialization.