Search

Copyright of Annals of Social Sciences / Roczniki Nauk Społecznych is the property of Towarzystwo Naukowe KUL & Katolicki Uniwersytet Lubelski Jana Pawla II and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

In today's connected society, ensuring safety and security in cyberspace is an extremely tough challenge. NTT Security Holdings provides security services to clients on the basis of its proprietary cyber intelligence and threat-detection-and-response capabilities. We asked Shinichi Yokohama, chief executive officer of NTT Security Holdings and chief information security officer of the NTT Group, about the company's mission and strategy as well as his attitude as a top management. [ABSTRACT FROM AUTHOR]

Computer and Information Security (CIS) is usually approached adopting a technology-centric viewpoint, where the human components of sociotechnical systems are generally considered as their weakest part, with little consideration for the end users' cognitive characteristics, needs and motivations. This paper presents a holistic/Human Factors (HF) approach, where the individual, organisational and technological factors are investigated in pilot healthcare organisations to show how HF vulnerabilities may impact on cybersecurity risks. An overview of current challenges in relation to cybersecurity is first provided, followed by the presentation of an integrated top–down and bottom–up methodology using qualitative and quantitative research methods to assess the level of maturity of the pilot organisations with respect to their capability to face and tackle cyber threats and attacks. This approach adopts a user-centred perspective, involving both the organisations' management and employees, The results show that a better cyber-security culture does not always correspond with more rule compliant behaviour. In addition, conflicts among cybersecurity rules and procedures may trigger human vulnerabilities. In conclusion, the integration of traditional technical solutions with guidelines to enhance CIS systems by leveraging HF in cybersecurity may lead to the adoption of non-technical countermeasures (such as user awareness) for a comprehensive and holistic way to manage cyber security in organisations. [ABSTRACT FROM AUTHOR]

Cyber attacks have become increasingly complicated, persistent, organized, and weaponized. Faces with this situation, drives a rising number of organizations across the world are showing a growing willingness to leverage the open exchange of cyber threat intelligence (CTI) for obtaining a full picture of the fast-evolving cyber threat situation and protecting themselves against cyber-attacks. However, modeling CTI is challenging due to the explicit and implicit relationships among CTI and the heterogeneity of cyber-threat infrastructure nodes involved in CTI. Owing to the limited labels of cyber threat infrastructure nodes involved in CTI, automatically identifying the threat type of infrastructure nodes for early warning is also challenging. To tackle these challenges, a practical system called HinCTI is developed for modeling cyber threat intelligence and identifying threat types. We first design a threat intelligence meta-schema to depict the semantic relatedness of infrastructure nodes. We then model cyber threat intelligence on heterogeneous information network (HIN), which can integrate various types of infrastructure nodes and rich relations among them. Following, we define a meta-path and meta-graph instances-based threat Infrastructure similarity (MIIS) measure between threat infrastructure nodes and present a MIIS measure-based heterogeneous graph convolutional network (GCN) approach to identify the threat types of infrastructure nodes involved in CTI. Moreover, through the hierarchical regularization strategy, our model can alleviate the problem of overfitting and achieve good results in the threat type identification of infrastructure nodes. To the best of our knowledge, this work is the first to model CTI on HIN for threat identification and propose a heterogeneous GCN-based approach for threat type identification of infrastructure nodes. With HinCTI, comprehensive experiments are conducted on real-world datasets, and experimental results demonstrate that our proposed approach can significantly improve the performance of threat type identification compared to the existing state-of-the-art baseline methods. Our work is beneficial to greatly relieve security analysts from heavy analysis work and efficiently protect organizations against cyber-attacks. [ABSTRACT FROM AUTHOR]

Ensuring a good level of cybersecurity of global IT systems requires that specific procedures and cooperation frameworks be adopted for reporting threats and for coordinating the activities undertaken by individual entities. Technical infrastructure enabling safe and reliable online collaboration between all teams responsible for security is an important element of the system as well. With the above taken into consideration, the paper presents a comprehensive distributed solution for continuous monitoring and detection of threats that may affect services that provision is essential to security and broadly understood the state's economic interests. The said solution allows to collect, process and share distributed knowledge on hazard events. The partnership-based model of cooperation between the system's users allows the teams to undertake specific activities at the central level, facilitates global cyber threat awareness, and enhances the process of predicting and assessing cyber risks in order to ensure a near-real-time response. The paper presents an overview of the system's architecture, its main components, features, and threat intelligence tools supporting the safe sharing of information concerning specific events. It also offers a brief overview of the system's deployment and its testing in an operational environment of NASK's Computer Security Incident Response Team (CSIRT) and Security Operation Center (SOC) of essential services operators. [ABSTRACT FROM AUTHOR]

In the new and evolving digitalized world, the cybersecurity threats have placed the assets and information of corporations, institutions, governments, and individuals at constant risk. Banks are not an exception. Offering the low-interest rate is becoming the fundamental strategic move of the banks to sustain. Due to the high demand for a tailored portfolio of financial products, the availability of sophisticated communication and advance transaction mechanisms lead to an emergence of a new type of competitor known as financial technology service (i.e., fintech). The collaboration between these fintech organizations and banks has recently increased to provide fine-tuned service to the consumer and satisfy emerging market needs. However, this collaboration between banks and fintech firms has triggered significant cybersecurity risk. Hence, the dilemma is whether the bank should embrace such collaboration to resuscitate the profit margin or be pragmatic, and shirk to eliminate sustainability risk? We argue that the alliance between bank and fintech firms triggers a high-level of cybersecurity risk. We propose a theoretical model and discuss various types of cybersecurity risks. The benefit (or cost-if any) of having alliance could be enormous in yielding profitability and increase sustainability if both fintech and banks collaboratively abate the cybersecurity risks. [ABSTRACT FROM AUTHOR]

CTI Expands the Collection Spectrum Commercial providers of CTI usually have sensors placed in customer networks. CTI Increases the Intelligence Community of Practice The CTI community did not grow on its own. Many CTI community conference talks paraphrase their work, together with Priority Intelligence Requirements and Kent's Words of Estimative Probability.[11] Currently, however, the CTI field seems to be stuck at assuming this borrowed terminology. Gartner has predicted that 20% of large enterprises will use commercial services to inform their CTI by 2022.[4] The commercial CTI market is expected to grow from 5.3 billion USD in 2018 to 12.9 billion in 2023, at a compound annual growth rate of 19.7%.[5] The CTI community consists of commercial, independent, and private-sector researchers who share their analysis in various ways and forms. [Extracted from the article]

Regulators have evolved organizational processes, capacities, and expertise that aim to balance public goods such as reliability, affordability, and environmental protection. However, cybersecurity is a different kind of good. It requires continual vigilance by experts and continual advancements in their practices as cybersecurity involves intelligent adversaries that seek to undermine it. Regulators have thus expressed concern that neither they nor the companies they regulate have the expertise to ensure that critical infrastructure remains uncompromised. This Article examines such expertise as an authoritative relationship between individuals claiming specialized skills and those without such training. In particular, it considers how public utility commissions help produce critical infrastructure cybersecurity expertise. It argues that the commissions have not merely accessed expertise but have worked with skilled individuals to actively produce expertise. The analysis highlights three contexts and processes for producing such expertise. First, after breaches occur in utility networks, commission experts highlight industry-accepted best practices and standards--not only to explain the breaches, but to emphasize that they possess specialized knowledge that could have prevented such breaches. Second, commission experts maintain ongoing discussions with utilities, such that utility requests for rate recovery associated with cybersecurity investments rarely need to be publicly challenged--a process which might reveal disagreement among experts and undermine authority. Third, when experts are called upon to help establish cybersecurity standards, they have attempted to remain neutral and facilitate agreement among industry experts. However, in the midst of public controversy about appropriate standards, regulators have at times struggled to maintain their authority. [ABSTRACT FROM AUTHOR]

ITSs are attracting much attention from the industry, academia and government in staging the new generation of transportation. Meanwhile, cyber security concerns are growing since cyber-attacks are prevalent and their behaviors are becoming more complex. Recently, game theory has been used to model the behaviors of these complex attacks and predict their future behaviors. In this article, we present a survey on how game theory can be used to protect ITSs from attacks and assess the pros and cons in terms of security level and required cost. Moreover, we propose a new cyber security Stackelberg game based framework to identify a relevant attack's features and subsequently improve the efficiency of detection. [ABSTRACT FROM AUTHOR]

A number of security certifications for small- and medium-size enterprises have been proposed, but how effective are these schemes? We evaluated the effectiveness of Cyber Essentials and found that its security controls work well to mitigate threats that exploit vulnerabilities remotely with commodity-level tools. [ABSTRACT FROM AUTHOR]

In response to the demand for cybersecurity professionals, schools are developing new academic programs in cybersecurity. The first four cybersecurity programs accredited by the ABET illustrate different ways to offer a four-year undergraduate cybersecurity degree. [ABSTRACT FROM AUTHOR]

To remain competitive in a digital economy, the United States must broaden computing and cybersecurity education and career pathways. Our results provide insight into teachers' knowledge growth, their understanding of cyber principles, and their application of these principles in the classroom. [ABSTRACT FROM AUTHOR]

Three current cybersecurity professional and academic program schemes target cyber education, training, and workforce roles. They have complementary elements that can serve as a pathway from learning cyber to working cyber if correctly navigated. [ABSTRACT FROM AUTHOR]

Along with the development of information technology in recent years, awareness about the security of computer systems is also increasing. Because the human factor is often guilty of the vulnerabilities to which an information system is exposed, this paper will research and evaluate disparate attack vectors which are being utilized today to successfully exploit human weaknesses. We will also try to create a mechanism to mitigate against these attack vectors. [ABSTRACT FROM AUTHOR]