Vulnerabilities disclosure deeply divides

Security assessment of a system is a difficult problem. Most of the current efforts in security assessment involve searching for known vulnerabilities. Finding unknown vulnerabilities still largely remains a subjective process. The process can be improved by understanding the characteristics and nature of known vulnerabilities. The knowledge thus gained can be organized into a suitable taxonomy, which can then be used as a framework for systematically examining new systems for similar but as yet unknown vulnerabilities. There have been many attempts at producing such taxonomies. This article provides a comprehensive survey of the important work done on developing taxonomies of attacks and vulnerabilities in computer systems. This survey covers work done in security related taxonomies from 1974 until 2006. Apart from providing a state-of-the-art survey of taxonomies, we also analyze their effectiveness for use in a security assessment process. Finally, we summarize the important properties of various taxonomies to provide a framework for organizing information about known attacks and vulnerabilities into a taxonomy that would benefit the security assessment process.

In this contemporary digital age, cybersecurity stands as a crucial linchpin amid the expanding role of technology in our lives, encountering numerous challenges. This review addresses the imperative need for robust cybersecurity measures as malicious actors continually innovate methods to exploit vulnerabilities in computer systems, networks, and data. The exploration delves into the multifaceted realm of cybersecurity attacks, unveiling the evolving threat landscape and their profound implications. From cybercriminals utilizing phishing attacks to the covert tactics of malware and the disruptive potential of Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, including Phishing, Zero-Day Exploits, Man-in-the-Middle, and SQL Injection Attacks, the cybersecurity battleground is ever-expanding. The study systematically categorizes cyber threats, scrutinizes their distinctive characteristics, and elucidates the modus operandi of each attack type. Through a meticulous dissection of cybercriminal methods and motivations and a comprehensive evaluation of countermeasure efficacy, this review offers indispensable insights for securing our digital future in an era marked by escalating interconnectivity and technological dependence.

Deception is essential to and inherent in cyber operations of all kinds. In defensive cyber operations, deception is the third line of defence after authentication and access control. Deception can be supported by intrusion detection systems monitoring for suspicious activity. Honeypots are the most obvious technique for misleading intruders, but delaying execution of commands, giving false excuses, and lying about the results may be more effective in some circumstances. Proactive defences also depend on deception. In offensive cyber operations, the attacker may manipulate someone to gain information. He/she may masquerade as an authorised user to access the target system or escalate privileges, install a rootkit to conceal his/her actions, bypass access control by installing a back door, or exfiltrate collected data within normal traffic. There is a wealth of theories of deception, overwhelmingly based on the physical world. Some theories are generic, others are specific to military operations, but few are specific to cyber deception. Some focus on the entities involved, while others focus on the deception process, which itself may be organisational or psychological. Several authors warn that analogies drawn from the physical environment may be counterintuitive in cyberspace. As Miller, Brickey and Conti (2012) memorably express it: “weapons can be reproduced instantly, ‘bullets’ travel at near the speed of light, destroyed targets can be brought back from the dead, and a seventeen year old can command an army”. This warning also applies to deception theory. The purpose of this paper is to evaluate key theories of deception for applicability to cyber operations in a multi-domain environment. There are five chapters. After the Introduction, Chapter 2 summarises relevant theory and doctrine. Chapter 3 summarises seven key theories of deception. Chapter 4 evaluates them, and outlines an ideal theory. Finally, Chapter 5 draws conclusions and recommends further work.

Analysis of computer abuse experience is valuable in threat and risk studies performed to develop appropriate safeguards in computer use. A profile of computer abuse perpetrators has been developed on the basis of interviews with 17 offenders involved in a total of 15 cases. Common characteristics, occupations, and modus operandi are documented and analyzed. Computer systems' and user organizations' vulnerabilities that facilitated perpetrators' actions are also described, based on study of 375 reported cases of abuse. Eight main vulnerable functions and nine main vulnerable functional locations are identified and ranked by incidence of occurrence. Each vulnerability is described by examples in the form of brief case descriptions. Finally, priorities for safeguards are deduced from the results of the study.

As offensive cyber operations have become more commonplace, cyber collateral damage (CCD) to society and to civilian infrastructure has expanded in impact and severity. Several research contexts, frameworks, and methods apply to these collateral effects, especially as they pertain to reducing them. To investigate and map this area of research, five leading scientific databases (Scopus, IEEE Xplore, Springer Link, ScienceDirect, and ProQuest) were searched for papers on CCD. From 716 search results, 74 relevant papers were selected. Using surface categories as well as thematic analysis, these were grouped into the main emergent categories of legal, ethical, targeting-oriented, and econometric papers, with each category showing a recent research trend. The papers were qualitatively assessed for importance and coverage and compared bibliographically to identify key papers and authors. Within the identified areas of research, significant gaps remain. While CCD is becoming increasingly well understood from a legal and operational perspective, this accounts only for a fraction of the civilian harm caused by offensive cyber operations. This study identifies potential pathways for the synthesis of the current research areas (targeting, taxonomy, econometrics) with broader definitions of collateral damage to include civilian harm. These include updating national cyber doctrines to require collateral damage estimates, as well as exploiting emerging open datasets to understand which cyber capabilities cause the greatest collateral effects. Finally, we observe that the research definitions and taxonomy of CCD differ widely and have been subjected to limited scrutiny and challenge to date.

Cyber security is neither an offensive panacea nor the Pearl-Harbor-like vulnerability it is imagined to be. The conclusions review how it is uniquely difficult to create effects successfully, continuously and meaningfully through offensive cyber operations (OCOs) in a military context. They require immense investment, operational discipline, and access to immense amounts of accurate targeting intelligence. While many countries actively use--or plan to--OCOs, few do so very well. The United States is uniquely positioned to deliver both tactical and strategic effects alongside combat operations and beyond them, but is often hampered by the limitations of its own bureaucracy and shackling "cyber" within a domain of warfare. Russia is a prolific, aggressive and technically capable user of OCOs, but frequently makes operational errors which are costly in a high-accuracy medium such as OCOs. The Chinese People's Liberation Army invests significantly in creating capabilities suitable to its military aims but is as-of-yet untested in campaign-wide joint operations. Iran frequently punches above its weight in effects by creating low-complexity, noisy, but noticeable effects delivered through proxies and conventional forces.

La ciberseguridad se ha convertido en un tema crítico en la era digital, donde los avances tecnológicos han facilitado tanto la vida cotidiana como las actividades delictivas. Este artículo presenta una propuesta de prototipo de herramienta de monitoreo y análisis de eventos informáticos para contar con un componente de seguridad con la finalidad de reforzar nuestra navegación y uso de sistemas web en pequeños negocios, redes domesticas o medias empresas enfocando en la ciberseguridad. Se explora cómo los ciberdelincuentes aprovechan vulnerabilidades en sistemas informáticos y redes para acceder ilegalmente a información sensible o para interrumpir servicios críticos. Además, examinamos la evolución de las tácticas de ataque, destacando la sofisticación creciente de los métodos empleados y su adaptación a las defensas cibernéticas. Se aborda también la importancia de contar con un sistema de detección de eventos que se encuentre al alcance de prácticamente cualquier persona, empresa pequeña o mediana que este preocupada por velar por la integridad de su información y disponibilidad de la misma con el fin de lograr de lograr tener un cerco de seguridad que aporte visión y estrategias de seguridad de lo que fluye dentro de su red y sus dispositivos de cómputo. Finalmente, se concluye resaltando la necesidad de una colaboración continua para el desarrollo de tecnologías innovadoras y regulaciones efectivas para hacer frente al constante cambio y la sofisticación de las amenazas cibernéticas en el futuro.

Since the 1980s, Dutch volunteer hackers have been identifying and disclosing vulnerabilities in computer systems. Initially criminalized, these hackers now play a crucial role in Dutch cybersecurity governance. This article explores the transformation of hackers from criminals to crucial participants and examines what this case reveals about citizen participation in the digital age. The case study demonstrates that citizens can play a pivotal role in addressing challenges posed by digitization, although their contributions can remain unrecognized and constrained by hostile institutions. This article aims to deepen the understanding of various forms of citizen participation in digital society, how institutions can support or constrain them, and how citizens play a central role in shaping these institutions to legitimize their participation.

Cryptography in data processing

AI-Driven Framework for Intelligent Attack Detection and Dynamic Security Monitoring in Modern Digital Infrastructure

This study aims to develop a web-based malware detection system using Convolutional Neural Network (CNN) utilizing the IoT23 dataset. Malware is malicious software that can exploit security vulnerabilities in computer systems, steal data, and degrade performance. The implementation of this detection system involves CNN, capable of extracting important features from both visual and textual data, applied to malware classification. The IoT23 dataset comprises 23 scenarios of IoT network traffic, including traffic from malware-infected devices. The study results show that the developed web application can detect malware attacks with accuracy, precision, recall, and F1-score of 99% on separate data scenarios. This CNN-based detection system has proven effective in identifying and classifying malware attacks, contributing to the enhancement of network and device security.

Subject International law for cyberspace. Significance Currently there is significant uncertainty about the scope and applicability of traditional international law to cyber operations. Several multilateral and government-level efforts are underway to bring greater clarity to this new domain of geostrategic activity. Impacts The ability of victim states to take countermeasures for offensive cyber operations will be impeded by the lack of international rules. Western states will publicly attribute damaging cyber operations to specific actors, but the deterrence impact will be limited. Any consensus on international law will have implications for third-party contractors who provide cybersecurity services to state actors.

The aim of this chapter is to elaborate on the notion of ‘cyber operations’ against the generic manner in which they are used by popular media as well as by academics. This chapter differentiates between actors and motives, covering operations conducted by both state and non-state entities. Special attention is paid to governmental cyber operations that are characterized by distinct roles and paradigms: governance, protection, law enforcement, intelligence and military operations. Despite similarities regarding means and methods used in various cyber operations, the critical test is the purpose of those launching such operations. For governmental actors, the purposes are vested in the aforementioned paradigms.

The Iranian government has exhibited significant creativity in achieving its regional security objectives. Hampered by crippling sanctions and faced with technologically superior adversaries, Iran continuously seeks to rebalance asymmetries through unconventional means of warfare. Iranian strategy includes high volumes of light, effective munitions, terrorism and a significant investment in compatible proxy forces. Considering the deep reliance of Iran's enemies on information networks and technological superiority, it is no surprise that Iran attempts to achieve its objectives through the targeting of these elements. This chapter reviews how Iran uses commercial, academic and individual proxies alongside national forces such as the IRGC to carry out Offensive Cyber Operations (OCOs) against its enemies, to some degree of success. While Iranian operations are riddled with errors and of limited technical sophistication, they are often good enough to create the desired effect. From Denial of Service attacks to Shamoon variants, this chapter explores a variety of Iranian attacks and capabilities and how they were employed as part of a broader strategy.

The integration of AI into cybersecurity represents a significant shift in the protection of digital infrastructures. AI enhances predictive threat detection, automated incident response, and real-time risk management, enabling more proactive security practices. However, the growing autonomy and opacity of AI systems introduce substantial legal, ethical, and governance challenges. This chapter examines these issues at the intersection of technological innovation and regulatory accountability, drawing on EU legal frameworks such as the AI Act and the AI Liability Directive. It analyses how algorithmic opacity and the “black box” problem undermine transparency, due process, and liability attribution, while highlighting persistent responsibility gaps and the dual-use nature of AI in defensive and offensive cyber operations. Emphasising explainable AI as a foundation for trustworthy governance, the chapter proposes a risk-based governance model that aligns technical explainability with legal accountability and human oversight to enhance digital trust and protect fundamental rights.