Suchergebnisse

Daily advancing technologies and next-generation networks are creating entirely dierent digital environments for people, organizations, and governments within the next several years. Because cybersecurity provision in such environments involves many actors and must overcome many evolving threats and challenges, strategies must be responsive and multi-pronged. Development and execution of suficiently savvy strategies to face the complex problems in this context necessitate identification of all the actors and operations that aect, directly or indirectly, on the cybersecurity of the digital ecosystems. In this study, we seek to provoke thinking about how actors and stakeholders could get better at crafting successful cybersecurity strategies, and identify and integrate specic types of skills required to formulation these strategies taking into account where decisions are actually made. This work provides an insight into cybersecurity education, calibrating and differentiating knowledge and skills to make the right demands on the right actors who have the authority and responsiveness to introduce change from multiple entry points. This enables practitioners to adopt more hands-on approaches that can be helpful to improve transparency, accountability and collaboration across levels of a socio-technical system.

In cybersecurity economics, the selection of a particular methodology is a matter of interest and importance for the researchers. Methodologically sophisticated research forms an essential basis for understanding the challenges and opportunities for the richer descriptions of the behavior of cybersecurity practitioners (i.e., what they are doing and why they are doing it). This requires a broad and self-reflective approach to understand the use of a technique in socio-technical research within cybersecurity economics. Such understanding recognizes that research in this field involves more than just applying a method to create knowledge and diffuse it throughout society, organizations, and governments. This paper argues in favor of a multi-paradigmatic approach to cybersecurity economics research. Rather than adopting a single paradigm, this study suggests that results will be more prosperous and reliable if different methods from different existing paradigms are combined. Hence, it puts forward the desirability and feasibility of the multi-paradigmatic approach in cybersecurity economics research. It also outlines several practical guidelines that help design multi-paradigmatic research studies. These are illustrated with a critical evaluation of three examples of studies. ; publishedVersion

Insights in the field of cybersecurity economics empower decision makers to make informed decisions that improve their evaluation and management of situations that may lead to catastrophic consequences and threaten the sustainability of digital ecosystems. By drawing on these insights, cybersecurity practitioners have been able to respond to many complex problems that have emerged within the context of cybersecurity over the last two decades. The academic field of cybersecurity economics is highly interdisciplinary since it combines core findings and tools from disciplines such as sociology, psychology, law, political science, and computer science. This study aims to develop an extensive and consistent survey based on a literature review and publicly available reports. This review contributes by aggregating the available knowledge from 28 studies, out of a collection of 628 scholarly articles, to answer five specific research questions. The focus is how identified topics have been conceptualized and studied variously. This review shows that most of the cybersecurity economics models are transitioning from unrealistic, unverifiable, or highly simplified fundamental premises toward dynamic, stochastic, and generalizable models. ; publishedVersion

Cybersecurity decisions are made across a range of social, technical, economic, regulatory and political domains. There is a gap between what companies and institutions plan to do while developing their internal IS-related policies and what should be done according to a multi-stakeholder system perspective in this area. Our task as researchers is to bridge this gap by offering potential solutions. The aim of our work is to promote the usage of the socio-technical systems (STS) approach to support the emerging role of systems thinking in cybersecurity education, using simulation as a supporting tool for learning. Meanwhile, new trends in cybersecurity curricula suggest an important shift toward new thinking approaches such as adversarial and systems thinking. We explored individuals' adversarial and systems thinking skills in an open agent-based simulated environment and subsequently assessed the impact based on a participant survey. We discuss these results and point to directions for further investigation. The second contribution of the article is the provision of a tool for developing target users' skills in making quantitative risk decisions and giving them a deeper understanding of the importance and use of key indices in the cyber risk management process. ; publishedVersion ; © 2019 Erjon Zoto et al. This is an open access article licensed under the Creative Commons Attribution License (http://creativecommons.org/licenses/by/4.0).

Cybersecurity decisions are made across a range of social, technical, economic, regulatory and political domains. There is a gap between what companies and institutions plan to do while developing their internal IS-related policies and what should be done according to a multi-stakeholder system perspective in this area. Our task as researchers is to bridge this gap by offering potential solutions. The aim of our work is to promote the usage of the socio-technical systems (STS) approach to support the emerging role of systems thinking in cybersecurity education, using simulation as a supporting tool for learning. Meanwhile, new trends in cybersecurity curricula suggest an important shift toward new thinking approaches such as adversarial and systems thinking. We explored individuals' adversarial and systems thinking skills in an open agent-based simulated environment and subsequently assessed the impact based on a participant survey. We discuss these results and point to directions for further investigation. The second contribution of the article is the provision of a tool for developing target users' skills in making quantitative risk decisions and giving them a deeper understanding of the importance and use of key indices in the cyber risk management process.

In this paper we discuss a work in progress to create a socio-technical system design framework for cyber security training exercises (STSD-CSTE) to support the development of cyber security training in the Norwegian Cyber Range. The process to create the framework started by first performing a socio-technical systems root cause analysis of an Advanced Persistent Threat (APT) incident called "Operation Socialist". Operation Socialist was the code name given by the British signals and communications agency Government Communications Headquarters (GCHQ) to an operation in which they successfully breached the infrastructure of the Belgian telecommunications company Belgacom (now Proximus Group) between 2010 and 2013. To extract relevant information from the case four socio-technical systems models were tested. The four models integrated into one framework were a Cassano-Piche Structural Hierarchy model, the "Security By Consensus" model, the Kowalski Socio-Technical systems dynamic model and Withword's 8 criterial model. After this framework has been reviewed by the socio-technical research community we plan to test the framework with exercises in the Norwegian Cyber Range (NCR) environment. NCR will be an arena where testing, training, and exercise will be used to expose individuals, public and private organizations and government agencies to simulate socio-technical cyber security events and situations in a realistic but safe environment. ; publishedVersion ; Copyright © 2019 by the authors. Creative Commons License Attribution 4.0 International (CC BY 4.0)