Organizational Cybersecurity: Advanced Cyber Defense, Cyber Analytics, and Security Operations
Permanent URI for this collection
Browse
Recent Submissions
1 - 8 of 8
-
ItemCapturing the Dynamic Nature of Cyber Risk: Evidence from an Explorative Case Study( 2023-01-03)In this research, we developed a novel approach to enable a dynamic cyber risk management strategy as the dynamic nature of cyber risk is rarely considered in current decision support tools. Our explorative case study shows that many management challenges such as investment decisions, priority setting, and “shelf time” analyses can be continuously analyzed. Our research using system thinking and modelling provides valuable insights about these challenges to support current strategic decision-making practices and improve managerial learning. These insights enable management to identify and analyze the effectiveness of future cyber risk management strategies before implementing them.
-
ItemManaging Organizational Cyber Security – The Distinct Role of Internalized Responsibility( 2023-01-03)Desirable user behavior is key to cyber security in organizations. However, a comprehensive overview on how to manage user behavior effectively, in order to support organizational cyber security, is missing. Building on extant research to identify central components of organizational cyber security management and on a qualitative analysis based on 20 semi-structured interviews with users and IT-Managers of a European university, we present an integrated model on this issue. We contribute to understanding the interrelations of namely user awareness, user IT-capabilities, organizational IT, user behavior, and especially internalized responsibility and relation to organizational cyber security.
-
ItemBridging the Gap between Security Competencies and Security Threats: Toward a Cyber Security Domain Model( 2023-01-03)Security incidents are increasing in a wide range of organizational types and sizes worldwide. Although various threat models already exist to classify security threats, they seem to take insufficient account of which organizational assets the threat events are targeting. Therefore, we argue that conducting more job-specific IT security training is necessary to ensure organizational IT security. This requires considering which assets employees use in their daily work and for which threat events employees need to build up IT security competencies. Subsequently, we build a framework-based Cyber Security Domain Model (CSDM) for IT-secure behavior. We follow the Evidence Centered Assessment Design (ECD) to provide a deep- dive analysis of the domain for IT-secure behavior. As the leading result relevant for research and practice, we present our CSDM consisting of 1,087 cyber threat vectors and apply it to five job specifications.
-
ItemMarket Reaction to Cyber Strategy Disclosure: Word Embedding Derived Approach( 2023-01-03)In this study, we use a semi-supervised natural language processing (NLP) methodology to assess cybersecurity strategy of firms based on their 10-K filings. Adapted from the Cybersecurity Framework developed by the National Institute of Standards and Technology (NIST), five distinct cybersecurity strategies, namely identification, protection, detection, response, and recovery, are measured annually. We find evidence that cybersecurity identification strategy is positively and significantly associated with firm market value. For those firms experienced a cyberattack in the past, disclosing cybersecurity protection strategy is not positively assessed by the market. This paper makes contribution to the literature on cybersecurity by identifying the cyber strategies disclosed in 10-K reports using textual analysis, which can be used in future cyber studies. We further show empirical evidence of how market reacts to different strategies, which have valuable implications for industry as to how to better manage cyber risk.
-
ItemConnecting the Dots: An Assessment of Cyber-risks in Networked Building and Municipal Infrastructure Systems( 2023-01-03)The buildings and city streets we walk down are changing. Driven by various data-driven use cases, there is increased interest in networking and integrating lighting and other building systems (e.g., heating, ventilation, and air conditioning (HVAC), security, scheduling) that were previously not internet-facing, and equipping them with sensors that collect information about their environment and the people that inhabit it. These data-enabled systems can potentially deliver improved occupant and resident experiences and help meet the U.S. Department of Energy (DOE) national energy and carbon reduction goals. Deploying connected devices new to being networked, however, is not without its challenges. This paper explores tools available to system designers and integrators that facilitate a cybersecurity landscape assessment – or more specifically the identification of threats, vulnerabilities, and adversarial behaviors that could be used against these networked systems. These assessments can help stakeholders shift security prioritization proactively toward the beginning of the development process.
-
Item
-
ItemSustainable Information Security Sensitization in SMEs: Designing Measures with Long-Term Effect( 2023-01-03)This paper outlines an overall scenario for ongoing personnel development measures designed to increase information security awareness in small and medium-sized enterprises (SMEs) in Germany and to help small businesses improve their security levels and defenses. The three-year project combines different actors and a multitude of methods, with a focus on conducting interviews and online surveys with companies, developing customized game-based awareness trainings, tests, and on-site attacks, and creating measurements and evaluations as well as maturity statements, guidelines, and low-threshold security concepts. A mix of analog/digital serious games and operational trainings with reviews are of key importance here. Compared with the findings from the applied scientific literature on behavioral research and design, the ultimate goal at project’s end is to extrapolate statements on the success and efficacy of the measures and their long-term effect.
-
ItemUnderstanding the Role of Leadership Competencies in Cyber Crisis Management: A Case Study( 2023-01-03)The amount and severity of cyber-attacks has been constantly increasing in recent years, and the number of cyber-related organizational crises grew accordingly. Despite the relevance of the topic, the literature on the subject is still limited, especially from a non-technical point of view. In the context of leadership, traditional crisis management literature identified specific competencies that organizations can leverage to mitigate the effects of a crisis, but there is a research gap as to whether or not these capabilities make sense in a cyber crisis context. This study aims to bridge this gap by analyzing the case of Norsk Hydro – a Norwegian company that in 2019 fell victim of a disruptive ransomware attack – through the lenses of a traditional crisis leadership model.