Optimizing Cybersecurity Budgets with AttackSimulation

Modern organizations need effective ways to assess cybersecurity risk. Successful cyber attacks can result in data breaches, which may inflict significant loss of money, time, and public trust. Small businesses and non-profit organizations have limited resources to invest in cybersecurity controls and often do not have the in-house expertise to assess their risk. Cyber threat actors also vary in sophistication, motivation, and effectiveness. This paper builds on the previous work of Lerums et al., who presented an AnyLogic model for simulating aspects of a cyber attack and the efficacy of controls in a generic enterprise network. This paper argues that their model is an effective quantitative means of measuring the probability of success of a threat actor and implements two primary changes to increase the model\u27s accuracy. First, the authors modified the model\u27s inputs, allowing users to select threat actors based on the organization\u27s specific threat model. Threat actor effectiveness is evaluated based on publicly available breach data (in addition to security control efficacy), resulting in further refined attack success probabilities. Second, all three elements - threat effectiveness, control efficacy, and model variance - are computed and evaluated at each node to increase the estimation fidelity in place of pooled variance calculations. Visualization graphs, multiple simulation runs (up to 1 million), attack path customization, and code efficiency changes are also implemented. The result is a simulation tool that provides valuable insight to decision-makers and practitioners about where to most efficiently invest resources in their computing environment to increase cybersecurity posture. AttackSimulation and its source code are freely available on GitHub

Cyberattacks on critical infrastructure: an economic perspective

The aim of this article is to analyze the economic aspects of cybersecurity of critical infrastructure defined as physical or virtual systems and assets that are vital to a country’s functioning and whose incapacitation or destruction would have a debilitating impact on national, economic, military and public security. The functioning of modern states, firms and individuals increasingly relies on digital or cyber technologies and this trend has also materialized in various facets of critical infrastructure. Critical infrastructure presents a new cybersecurity area of attacks and threats that requires the attention of regulators and service providers. Deploying critical infrastructure systems without suitable cybersecurity might make them vulnerable to intrinsic failures or malicious attacks and result in serious negative consequences. In this article a fuller view of costs and losses associated with cyberattacks that includes both private and external (social) costs is proposed. An application of the cost-benefit analysis or the Return on Security Investment (ROSI) indicator is presented to evaluate the worthiness of cybersecurity efforts and analyze the costs associated with some major cyberattacks in recent years. The “Identify, Protect, Detect, Respond and Recover” (IPDRR) framework of organizing cybersecurity efforts is also proposed as well as an illustration as to how the blockchain technology could be utilized to improve security and efficiency within a critical infrastructure

Control priorization model for improving information security risk assessment

Evaluating particular assets for information security risk assessment should take into consideration the availability of adequate resources and return on investments (ROI). Despite the need for a good risk assessment framework, many of the existing frameworks lack of granularity guidelines and mostly depend on qualitative methods. Hence, they require additional time and cost to test all the information security controls. Further, the reliance on human inputs and feedback will increase subjective judgment in organizations. The main goal of this research is to design an efficient Information Security Control Prioritization (ISCP) model in improving the risk assessment process. Case studies based on penetration tests and vulnerability assessments were performed to gather data. Then, Technique for Order Performance by Similarity to Ideal Solution (TOPSIS) was used to prioritize them. A combination of sensitivity analysis and expert interviews were used to test and validate the model. Subsequently, the performance of the model was evaluated by the risk assessment experts. The results demonstrate that ISCP model improved the quality of information security control assessment in the organization. The model plays a significant role in prioritizing the critical security technical controls during the risk assessment process. Furthermore, the model’s output supports ROI by identifying the appropriate controls to mitigate risks to an acceptable level in the organizations. The major contribution of this research is the development of a model which minimizes the uncertainty, cost and time of the information security control assessment. Thus, the clear practical guidelines will help organizations to prioritize important controls reliably and more efficiently. All these contributions will minimize resource utilization and maximize the organization’s information security

Economic Valuation for Information Security Investment: A Systematic Literature Review

Research on technological aspects of information security risk is a well-established area and familiar territory for most information security professionals. The same cannot be said about the economic value of information security investments in organisations. While there is an emerging research base investigating suitable approaches measuring the value of investments in information security, it remains difficult for practitioners to identify key approaches in current research. To address this issue, we conducted a systematic literature review on approaches used to evaluate investments in information security. Following a defined review protocol, we searched several databases for relevant primary studies and extracted key details from the identified studies to answer our research questions. The contributions of this work include: a comparison framework and a catalogue of existing approaches and trends that would help researchers and practitioners navigate existing work; categorisation and mapping of approaches according to their key elements and components; and a summary of key challenges and benefits of existing work, which should help focus future research efforts

An Optimization Framework for Generalized Relevance Learning Vector Quantization with Application to Z-Wave Device Fingerprinting

Z-Wave is low-power, low-cost Wireless Personal Area Network (WPAN) technology supporting Critical Infrastructure (CI) systems that are interconnected by government-to-internet pathways. Given that Z-wave is a relatively unsecure technology, Radio Frequency Distinct Native Attribute (RF-DNA) Fingerprinting is considered here to augment security by exploiting statistical features from selected signal responses. Related RF-DNA efforts include use of Multiple Discriminant Analysis (MDA) and Generalized Relevance Learning Vector Quantization-Improved (GRLVQI) classifiers, with GRLVQI outperforming MDA using empirically determined parameters. GRLVQI is optimized here for Z-Wave using a full factorial experiment with spreadsheet search and response surface methods. Two optimization measures are developed for assessing Z-Wave discrimination: 1) Relative Accuracy Percentage (RAP) for device classification, and 2) Mean Area Under the Curve (AUCM) for device identity (ID) verification. Primary benefits of the approach include: 1) generalizability to other wireless device technologies, and 2) improvement in GRLVQI device classification and device ID verification performance

A Conceptual Framework to Support Digital Transformation in Manufacturing Using an Integrated Business Process Management Approach

Digital transformation is no longer a future trend, as it has become a necessity for businesses to grow and remain competitive in the market. The fourth industrial revolution, called Industry 4.0, is at the heart of this transformation, and is supporting organizations in achieving benefits that were unthinkable a few years ago. The impact of Industry 4.0 enabling technologies in the manufacturing sector is undeniable, and their correct use offers benefits such as improved productivity and asset performance, reduced inefficiencies, lower production and maintenance costs, while enhancing system agility and flexibility. However, organizations have found the move towards digital transformation extremely challenging for several reasons, including a lack of standardized implementation protocols, emphasis on the introduction of new technologies without assessing their role within the business, the compartmentalization of digital initiatives from the rest of the business, and the large-scale implementation of digitalization without a realistic view of return on investment. To instill confidence and reduce the anxiety surrounding Industry 4.0 implementation in the manufacturing sector, this paper presents a conceptual framework based on business process management (BPM). The framework is informed by a content-centric literature review of Industry 4.0 technologies, its design principles, and BPM method. This integrated framework incorporates the factors that are often overlooked during digital transformation and presents a structured methodology that can be employed by manufacturing organizations to facilitate their transition towards Industry 4.0

Autonomous Goods Vehicles for Last-mile Delivery:Evaluation of Impact and Barriers

For transport logistics, often the most inefficient part of the journey is the route between distribution centre and end customer. This route, referred to as last-mile delivery, generally uses smaller goods vehicles, to deliver low-volumes to multiple destinations. To optimise this process, route planning optimisation software is used, to maximise the number of deliveries a driver can complete in a day. To further optimise this process, companies are starting to test autonomous goods vehicles (AGVs). This paper presents an evaluation of the impact and barriers of AGVs for last-mile delivery in the UK, by conducting a study of people in the logistics industry and experts in autonomous technology. Qualitative analysis is used to identify positive and negative impacts of the introduction of driverless AGVs, and barriers, in terms of government policy and technical restrictions, which could slow down wide-scale adoption. From the results, we find logistics companies are being pressured to reduce lead-times and offer more predictable delivery-times. This is increasing pressure on the workforce, which already has high-turnover and difficulties in recruitment. Therefore, AGVs are considered a solution to a present problem, which is preventing logistics companies growing and achieving delivery targets, driven by public demand.</p

Lessons learned from the commercial exploitation of marine battery energy storage systems

Large, reliable, and economically viable battery energy storage systems (BESSs) play a crucial role in electrifying the maritime industry. In this paper, we draw from the experiences of over 750 recent commercial marine BESS installations to bridge the gap between research findings and industrial needs in four key areas: (i) Decision-making for installations: We introduce a go/no-go-decision matrix for assessing the feasibility of installations in a maritime context. (ii) Safe and cost-effective installations: This study evaluates the risks and expenses associated with these BESS installations, including retrofitting a 500 kWh BESS (total costs: 1.3 million euros; 2600 euros per kWh), installing a 4.5 MWh BESS (5 million euros; 1100 euros per kWh), and an unsuccessful attempt to retrofit an 800 kWh BESS. (iii) Operation analysis: We delve into the operational outcomes of BESSs deployed on 47 offshore supply vessels (OSVs) (ranging from 452 to 1424 kWh) and a large 4.5 MWh BESS on a newly constructed cruise ship. The application of the equivalent full cycle (EFC) method reveals that the operational EFCs were notably lower than the designed EFCs. The proposed two new evaluation criteria assess the annual fuel saving resulting from BESS installed per kWh and per EFC. Over a two-year period, the 4.5 MWh BESS demonstrated fuel saving of 1–2 % as compared to the 5 % target. Addressing converter losses during low-power BESS operation modes necessitates further investigation. (iv) Further development: This study advocates for research aimed at enhancing safety measures, exploring onshore/offshore power supply and charging, optimizing multi-objective operations, and progressing towards zero emissions. The insights gathered in this paper can serve as a valuable resource for ship support ship owners and operators seeking to kick-off faster or to install more BESSs on their vessels and optimize their operational effectiveness

ADVANCED TECHNOLOGIES TO ENABLE OPTIMIZED MAINTENANCE PROCESSES IN EXTREME CONDITIONS: MACHINE LEARNING, ADDITIVE MANUFACTURING, AND CLOUD TECHNOLOGY

The way routine maintenance is conducted is not an optimal way to handle maintenance in extreme battlefield conditions. This is a common maintenance problem across various domains, such as repairing battle damage to aircraft or ships without access to a port or depot. The extreme conditions context can also include repairing the Alaska pipeline in the extreme cold, or handling repairs during COVID-19. The researcher examined how modern technology can optimize productivity and reduce the cycle time of the extreme maintenance process. The results of this research found that three emerging technologies, additive manufacturing, cloud in a box, and machine learning (ML), could improve process value, save labor costs, and reduce cycle time. ML had the most significant impact on improving productivity and cycle time. When all technologies were utilized together, productivity and cycle time improvement were more significant and consistent. The research accounted for the riskiness of these technologies, which is necessary to accurately forecast the value added for this extreme maintenance process context. This research is vital because getting correct valued repairs done quickly for the Department of Defense can make the difference between winning and losing a conflict.Distribution Statement A. Approved for public release: Distribution is unlimited.Civilian, Department of the Nav