Old, new, borrowed, blue --

At present, control system security efforts are primarily technical and reactive in nature. What has been overlooked is the need for proactive efforts, focused on the IT security research community from which new threats might emerge. Evaluating cutting edge IT security research and how it is evolving can provide defenders with valuable information regarding what new threats and tools they can anticipate in the future. Only known attack methodologies can be blocked, and there is a gap between what is known to the general security community and what is being done by cutting edge researchers --both those trying to protect systems and those trying to compromise them. The best security researchers communicate with others in their field; they know what cutting edge research is being done; what software can be penetrated via this research; and what new attack techniques and methodologies are being circulated in the black hat community. Standardization of control system applications, operating systems, and networking protocols is occurring at a rapid rate, following a path similar to the standardization of modern IT networks. Many attack methodologies used on IT systems can be ported over to the control system environment with little difficulty. It is extremely important to take advantage of the lag time between new research, its use on traditional IT networks, and the time it takes to port the research over for use on a control system network. Analyzing nascent trends in IT security and determining their applicability to control system networks provides significant information regarding defense mechanisms needed to secure critical infrastructure more effectively. This work provides the critical infrastructure community with a better understanding of how new attacks might be launched, what layers of defense will be needed to deter them, how the attacks could be detected, and how their impact could be limited.

The paper explores the role and legal protection of vulnerability reporters, namely cybersecurity researchers within the evolving EU cybersecurity framework. It examines who these researchers are, the value of their work, and the growing legal risks they face across Europe, as demonstrated by high-profile cases in the Netherlands, Malta, and Germany. Drawing on international human rights frameworks including EU Charter of Fundamental Rights, the paper argues that security research should be protected under the right to science and the freedom to conduct research. The paper advocates for defining ‘good-faith security research’ as a legally recognized safe harbour in EU law. A comparative analysis of selected international and EU legal frameworks, such as the UN Convention Against Cybercrime, Budapest Convention, EU Directive on attacks against information systems, the Cybersecurity Act, the NIS2 Directive, the Cyber Resilience Act, and national policies of a selected group of EU Member States, including the Netherlands, Belgium, France, Germany, Italy, Spain, Poland, Czechia, Slovakia, Malta along with the UK and the USA, reveals fragmented and insufficient protection. To address this, the paper calls for a coherent EU-wide framework based on two interlinked pillars: (i) mandatory coordinated vulnerability disclosure (CVD) procedures, and (ii) substantive legal exemptions for ethical security research. While the recent NIS2 Commission Implementing Regulation (EU) 2024/2690 for entities from digital infrastructure is a step forward, it lacks explicit protection for researchers. Therefore, the paper concludes with a call for integrating legal and technical safe harbours into EU cybersecurity legislation to ensure that vulnerability disclosure policies are not only adopted by entities but are also legally accessible and safe for the researchers, who rely on them.

This research-perspective article reviews and contributes to the literature that explains how to deter internal computer abuse (ICA), which is criminal computer behavior committed by organizational insiders. ICA accounts for a large portion of insider trading, fraud, embezzlement, the selling of trade secrets, customer privacy violations, and other criminal behaviors, all of which are highly damaging to organizations. Although ICA represents a momentous threat for organizations, and despite numerous calls to examine this behavior, the academic response has thus far been lukewarm. However, a few security researchers have examined ICA’s influence in an organizational context and addressed potential means of deterring it. However, the results of these studies have been mixed, leading to a debate on the applicability of deterrence theory (DT) to ICA. We argue that more compelling opportunities will arise in DT research if security researchers more deeply study its assumptions and more carefully recontextualize it. The purpose of this article is to advance a deterrence research agenda that is grounded in the pivotal criminological deterrence literature. Drawing on the distinction between absolute and restrictive deterrence and aligning them with rational choice theory (RCT), this paper shows how deterrence can be used to mitigate the participation in and frequency of ICA. We thus propose that future research on the deterrent effects of ICA should be anchored in a more general RCT, rather than in examinations of deterrence as an isolated construct. We then explain how adopting RCT with DT opens up new avenues of research. Consequently, we propose three areas for future research, which cover not only the implications for the study of ICA deterrence, but also the potential motivations for these types of offenses and the skills required to undertake them.

What are the key topics for Information Systems (IS) security researchers? How have these topics been changing, and what topics are emerging to offer new opportunities for research? We address these questions by analyzing the abstracts of 261 articles focusing on IS security that have appeared in leading IS journals and journals devoted to this area. Using Latent Semantic Analysis (LSA) to analyze the text of these abstracts uncovers five primary research topics: Security Design & Management, Business Operations Security, Behavioral Aspects, Authentication & Integrity Controls, and Prevention & Detection. These five primary topics are aggregates of more granular topics that are utilized to find trends to understand the changing complexion of IS security research. Our study contributes by developing the key topics and their trends in this area using an analytical and replicable method to synthesize the existing research.

With the rapid digitalization of educational institutions and the widespread adoption of training management platforms, ensuring robust data security and privacy protection has become a critical concern for educational stakeholders worldwide. This study presents a comprehensive testing design framework specifically tailored for data security and privacy protection in training management platforms. The research systematically examines the unique challenges posed by educational data environments, including sensitive student information handling, multi-stakeholder access controls, and regulatory compliance requirements under contemporary data protection legislation. Through the development of an integrated testing methodology that combines automated security scanning, privacy impact assessment procedures, and compliance verification protocols, this investigation demonstrates significant improvements in identifying and mitigating privacy vulnerabilities within educational platform environments. The proposed framework achieves 94% coverage of critical security scenarios while reducing privacy risk exposure by 67%, providing educational institutions with practical tools for maintaining data protection standards and ensuring regulatory compliance in increasingly complex digital learning environments.

Securing sensitive and critical information is a significant challenge for many organisations, as leaks can cause financial, reputational, and competitiveness losses. Organisations can implement an Information Security Policy (ISP) that employees must comply with to minimise this risk. However, ensuring compliance with the ISP continues to be a problem. To address this issue, a conceptual model has been proposed that organisations can use to promote ISP compliance behaviour among their employees. The Health Action Process Approach (HAPA) Model is used to derive this model. The model consists of two phases - motivational and volitional which are expected to cover the elements needed to promote behavioural change for ISP compliance. The model's multi-processes approach, covering critical aspects such as risk assessment, self-efficacy, initiation, and maintenance, enables it to serve as a platform for organisations to sustain ISP compliance over the long term. Organisations can conduct employee assessments and provide ISP compliance training and awareness campaigns to implement the model. They can also disseminate cues about information security issues and how the ISP can assist employees in handling them, discourage behaviour that leads to complacency towards ISP compliance, and update the ISP to keep it relevant. The proposed model presents an opportunity for future research to evaluate its applicability in organisational settings.

Introduction As many as 400 people may have access to one's personal medical information throughout the typical care process. Disclosures of sensitive information such as emotional problems, sexually transmitted diseases, substance abuse, and genetic predispositions to diseases---could cause embarrassment and affect insurability, child custody cases, and employment. A recent survey by IDC found that "Most consumers …were uncomfortable with their health plan sharing health information with a hospital, a specialist or their primary care doctor… (and) were concerned with who saw their information and were worried that the information could be made available online… (and) other respondents said they didn't trust their health plan or hospital to protect their information." Clearly, patients (consumers) feel that it is critical that their medical information is held in confidence. If patients do not feel that their personal medical information will be kept confidential, they may withhold important medical information from health care providers making it difficult to provide quality and effective health care. This issue of safeguarding sensitive patient information has become even more critical given that the Electronic Protected Health Information (PHI), in Electronic Medical Records (EMR) as mandated by the Health Insurance Portability and Accountability Act (HIPAA), may consist of a patient's medical, demographic and insurance information. Thus, presenting a significant information assurance and security challenge to the health care industry as reflected by the consumers' concerns related to building trust with health care community. If the health care industry falls behind in assuring the public that it can indeed safeguard patient information, then the initiative to create a more efficient and cost effective health care system by using Information Technology will be in serious jeopardy. The research presented in this article addresses this important information assurance and security challenge by building upon past research and presenting a framework of Information Assurance and Compliance developed through multi-site case study approach involving multiple health care providers in the U.S. Mercuri correctly identified that "solutions (to the information assurance challenge) are not as simple as adding on security tools and providing employees with policies and procedures for their job classification and requiring them to read and sign off on them." Information Assurance (IA) technologies such as encryption, password protection, access control mechanisms, and so on, for PHI may not be sufficient, since not all individual health care professionals may be familiar with the requirements of the law nor sufficiently motivated or trained to protect private and sensitive patient information. Health care Information Assurance policy (IA Policy) may be in place due to HIPPA requirements, but if health care employees fail to comply with such policy then patient information will be at a risk for disclosure. In this context, Mercuri correctly underscores the importance of human and management factors related to compliance by stating that "…the workers (must be given) a sufficient period in which to incorporate the new structures and rules into their culture and ethics. Otherwise efforts (related to IA Policy compliance) may be frustrated and unsuccessful." Even though human and management factors, related to compliance, have been recognized as important as technical factors in providing security to PHI in the health care industry, there is a lack of well-developed framework to understand IA policy compliance factors addressing the behavioral dimension in the context of patient health care information. Without such a framework, it is difficult to develop both managerial interventions and research studies in this important area of health care information assurance. The purpose of this research (using multi-site case research approach) is to present such a research framework that examines what factors affect health care employee's behavior to comply with information assurance (IA) policy related to protection of patient health care information. We also present sample measures to assess individual compliance. In the light of recent breaches and/ or theft of sensitive consumer data from banking, academic institutions, government agencies, and health care providers, this study provides a framework that can be extended and adapted to understand IA Policy issues in health care as well as in other industries. Therefore, the implication of this study is much broader and can be extended to other industries with appropriate adaptation. The unifying foundation for our research framework is the Theory of Reasoned Action (TRA). TRA posits that external factors affect beliefs and beliefs in turn affect attitudes, and attitudes affect intention which ultimately affect one's behavior. We examine how these concepts are related to one's behavior in complying with information assurance policy regarding patient health information. Using TRA, we build our framework on solid theoretical foundations drawing from research in technology acceptance model, information assurance and security, ethical behavior, organizational culture4 and health information management.

In a variety of areas such as the financial sector, the energy sector, the Internet of Things, and most importantly, healthcare, blockchain is evolving and advancing to serve as a secure and reliable platform to facilitate effective and secure data sharing. Electronic Health Data Management privacy issue has been raised when cloud-based data is shared between stakeholders or when records are outsourced to the cloud, resulting in sensitive or private information being disclosed by unauthorized individuals. As a result of the doctor referral management process, stakeholder communications are conducted via emails, faxes, and phone calls, which may result in errors, mistakes, and misunderstandings. This paper proposes the following solutions to the identified problems: To facilitate better sharing of healthcare records between clinicians and health care facilities through an efficient referral mechanism based on advanced smart contracts named as Patient Centric Healthcare Data Management Access Control via Smart contract (PCHDMAC-SC). Doctor referrals are made through the List referral system, which is patient-centric and restricted to doctors and other authorized providers. The results demonstrate that unauthorized access cannot be traced to healthcare records as all healthcare records are encrypted as part of the working model, which keeps personal information secure, protects personal information, makes data more scalable, and allows medical records to be shared and accessed more securely. Because of this, the system of doctor referrals results in scalability, a higher level of trust, and flexibility for all stakeholders involved.

PurposeThis paper proposes a new framework for optimizing investment decisions when deciding about information security remedies.Design/methodology/approachThe framework assumes that the organization is aware of a set of remedies that can be employed to address end‐effects that have been identified. The framework also assumes that the organization defines its information security policy by setting a minimum level of protection for each end‐effect. Given the two sets of costs, that of the end‐effect and the potential damage it can cause and that of the remedy and the required level of protection from each end‐effect, this framework can be used to identify the optimal set of remedies for a given budget that complies with the organization's information security policy. The framework is illustrated using a practical example concerning investment decision optimization in a financial organization.FindingsThe paper shows that exhausting the information security budget does not assure a higher level of security required by the organisation.Practical implicationsConcentrating on end‐effects and on the organizational requirements eases the process of remedy selection. The proposed methodology circumvents the common process of assuming probabilities of information security events.Originality/valueThis research proposes a practical and an easily implementable framework, enabling the information security manager to align the information security remedies and best practice methodological requirements with organizational budget constraints and business requirements while maintaining a required level of security.

Purpose: In today's world, data is gathered without any particular objective in mind; every action taken by a computer, or a human being is documented, and the data is studied in the future, if it is considered important to do so. The data will be subjected to several steps for analysis by a variety of parties, which raises the issue of trust in this context. There is a risk that the organizations involved in the analytical stages may abuse the data, which might contain private or sensitive information. Consequently, data privacy considerations should be carefully considered at this time. Methodology/Findings: A definition of "data privacy" is the practice of limiting access to information according to how important it is. People are usually very comfortable giving out their names to strangers, but they'll wait to give out their mobile phone numbers until they're more familiar with the individual. In this era of digital technology, important personal information is often the target of individuals' efforts to protect their data. From a business's point of view, data privacy encompasses more than just employees' and consumers' private information. Data privacy issues are often believed to be a barrier to the widespread adoption of AI and ML-driven technology. The reason for this is that ML can only be trained and tested on very large data sets. Implications to Theory, Practice and Policy: Imagine a world where trust is impossible to establish; here is where Blockchain technology might be useful. Blockchain uses the data anonymously. In this study, we provide a solution that ensures data security by integrating Blockchain technology with machine learning (Alfandi et al., 2020).

"Cloud" is a symbolic definition of Internet storage that can be accessed everywhere. This technology is swiftly gaining fame.1 Cloud computing is the state-of-the-art modernization in Information Technology (IT) and has provided a substitute mode for managing and accessing health data. It caters to various computing services such as intelligence, servers, storage, databases, networking, software, and analytics. Cloud computing administers fast modernization, flexible resources, and a range of economies. It is a colossal change from the traditional method due to its cost-effectiveness, high speed, security, global scale, performance, productivity, and reliability.2 Nowadays, hospitals/clinics successfully address patients needs through the cloud, and tech-savvy healthcare professionals are switching to this advancement for its benefits.3 Furthermore, it is an important step to move health systems and data to the cloud as it has achieved popularity during the pandemic. Cloud computing is accomplishing innovative systems to attain patient portals, offering interoperability and a protective way for important data to be transmitted quickly and efficiently anytime and everywhere. 4 Moreover, experts have predicted that cloud computing can improve services in healthcare and assets in healthcare research that have changed the appearance of information technology (IT).5 Because of these gains, there is a boost in the adoption of cloud computing to establish more satisfaction among patients and healthcare providers with low costs.6 Many healthcare systems still rely on old software systems. Healthcare workers' access to data such as electronic health records (EHR), patients' prescriptions, test results, and images/scans are more equipped to diagnose and identify the good management course. Decisions regarding large amounts of information help researchers and healthcare professionals identify patterns, and clues, uncover insights and provide evidence-based management.7 As a result of the cloud, the healthcare industry is regulated, and it makes sense that the first wave of moves to the cloud is those that have no direct impact on patient care. Healthcare providers are now comfortable with the impressive benefits of the cloud. The next wave of migration of information seems to be quicker and easier. Furthermore, telemedicine is the next strong contender for modernization in the future. A survey estimated that approximately 70 per cent of face-to-face interactions with the medical care provider did not require a routine appointment. A fraction of these interactions, telemedicine, would end in significant cost-effective healthcare delivery. It is a key objective for healthcare providers as insurers, and consumer costs would continue to arise. Another significant rise is patient empowerment tools which are cloud benefits as cloud-based applications (CBA) on smartwatches that help those with health-related chronic diseases, regular monitoring, and daily management. These are nutrition, exercise, medication reminders, and blood glucose monitoring that can be easily tracked through CBA, providing a platform for doctors to improve patient’s management further. Bettering outcomes, increased efficiency, and cost-effectiveness via CBA are important components that impact the healthcare system.8 Compliance and security are the main barriers to implementing community cloud in Pakistan’s healthcare system, and the challenges are fat.9 Pakistan’s medical system is still in the initial stages of shifting to this new technology. Healthcare information, X-Rays, medications, and patient history of government and non-government health services are increasing significantly in size, diversity, and rate in this country. 10 The demand for cloud services in Pakistan is improving daily.11 To sharpen and enhance the healthcare model of the health system, cloud-based solutions provide flexibility. Today, hospitals and physicians are gathering more information from patients and places due to this advancement. Virtual care services have grown over the past year when and where patients receive care. Doctors and physicians now have regular access to patient’s information from smartwatches that help update a patient’s treatment. Health information systems (HIS) and Health Management systems (HMS) have all the data for improving patient healthcare delivery connected across the healthcare continuum, and almost all healthcare providers have moved to the cloud. Historically it was a challenging process. The command of the cloud in healthcare is innovative in storing health information. It regards permission for the right care at the right time and place. CBS also provides a secure, integrated, and scalable foundation that supports a patient's health information within healthcare premises to develop the changes needed for tomorrow. HMS will provide a cost-effective and secure platform that will be important for data integrity and high-performance data replication for evidence-based decision and management.

SummaryJWTForge is a lightweight, open-source JSON Web Token (JWT) (RFC 7519) vending service designed specifically for developers and security researchers who need to test or surface vulnerabilities in the OAuth2 (RFC 6749) and OpenID Connect (OIDC) (see here) implementations.

Hosting services are associated with various security threats, yet the market has barely been studied empirically. Most security research has relied on routing data and equates providers with Autonomous Systems, ignoring the complexity and heterogeneity of the market. To overcome these limitations, we combined passive DNS data with WHOIS data to identify providers and some of their properties. We found 45,434 hosting providers, spread around a median address space size of 1,517 IP addresses. There is surprisingly little consolidation in the market, even though its services seem amenable to economies of scale. We applied cluster analysis on several measurable characteristics of providers. This uncovered a diverse set of business profiles and an indication of what fraction of the market fits each profile. The profiles are associated with significant differences in security performance, as measured by the uptime of phishing sites. This suggests the approach provides an effective way for security researchers to take the heterogeneity of the market into account.

This tutorial will introduce researchers to security related activities within some Internet standards development organisations (SDOs), mainly the Internet Engineering Task Force and the World Wide Web Consortium. Having reviewed basic structure and process issues, we will consider how both security researchers and the SDOs can benefit from improved interactions, and how researchers can best approach these SDOs with results. We will then consider a number of technical areas where additional security research or research outputs within the next 2-3 years would be of use to these SDOs. A number (perhaps 3) of these areas will be selected by the tutorial participants for detailed discussion on potentially relevant research. The topics range from the "political" layer (e.g. privacy, censor-reistant protocols), down to protocol-specific areas where highly focused research is needed (e.g. DHCP security, traffic analysis). The goal is to give participants an understanding of the needs and processes of these SDOs, so that researchers with relevant results can feed those into the Internet standards process, benefiting the work of those SDOs and possibly achieving greater real-world impact for the research.

IoT as a domain has grown so much in the last few years that it rivals that of the mobile network environments in terms of data volumes as well as cybersecurity threats. The confidentiality and privacy of data within IoT environments have become very important areas of security research within the last few years. More and more security experts are interested in designing robust IDS systems to protect IoT environments as a supplement to the more traditional security methods. Given that IoT devices are resource-constrained and have a heterogeneous protocol stack, most traditional intrusion detection approaches don’t work well within these schematic boundaries. This has led security researchers to innovate at the intersection of Machine Learning and IDS to solve the shortcomings of non-learning based IDS systems in the IoT ecosystem. Despite various ML algorithms already having high accuracy with IoT datasets, we can see a lack of sufficient production grade models. This survey paper details a comprehensive summary of the latest learning-based approaches used in IoT intrusion detection systems, and conducts a through critical review of these systems, potential pitfalls in ML pipelines, challenges from an ML perspective and discusses future research scope, and recommendations.