A systemic review of the cybersecurity challenges in Australian water infrastructure management

Cybersecurity risks have become obstinate problems for critical water infrastructure management in Australia and worldwide. Water management in Australia involves a vast complex of smart technical control systems interconnected with several networks, making the infrastructure susceptible to cyber-attacks. Therefore, ensuring the use of security mechanisms in the control system modules and communication networks for sensors and actuators is vital. The statistics show that Australia is facing frequent cyber-attacks, most of which are either undetected or overlooked or require immediate response. To address these cyber risks, Australia has changed from a country with negligible recognition of attacks on critical infrastructure to a country with improved capability to manage cyber warfare. However, little attention is paid to reducing the risk of attacks to the critical water infrastructure. This study aims to evaluate Australia’s current cybersecurity attack landscape and the implemented controls for water infrastructure using a systematic literature review (SLR). This study also compares Australia in the context of global developments and proposes future research directions. The synthesis of the evidence from 271 studies in this review indicates the importance of managing security vulnerabilities and threats in SCADA water control systems, including the need to upgrade the contemporary water security architecture to mitigate emerging risks. Moreover, human resource development with a specific focus on security awareness and training for SCADA employees is found to be lacking, which will be essential for alleviating cyber threats to the water infrastructure in Australia

The role of user behaviour in improving cyber security management

Information security has for long time been a field of study in computer science, software engineering, and information communications technology. The term ‘information security’ has recently been replaced with the more generic term cybersecurity. The goal of this paper is to show that, in addition to computer science studies, behavioural sciences focused on user behaviour can provide key techniques to help increase cyber security and mitigate the impact of attackers’ social engineering and cognitive hacking methods (i.e., spreading false information). Accordingly, in this paper, we identify current research on psychological traits and individual differences among computer system users that explain vulnerabilities to cyber security attacks and crimes. Our review shows that computer system users possess different cognitive capabilities which determine their ability to counter information security threats. We identify gaps in the existing research and provide possible psychological methods to help computer system users comply with security policies and thus increase network and information security

A machine learning predictive model to detect water quality and pollution

The increasing prevalence of marine pollution during the past few decades motivated recent research to help ease the situation. Typical water quality assessment requires continuous monitoring of water and sediments at remote locations with labour-intensive laboratory tests to determine the degree of pollution. We propose an automated water quality assessment framework where we formalise a predictive model using machine learning to infer the water quality and level of pollution using collected water and sediments samples. Firstly, due to the sparsity of sample collection locations, the amount of sediment samples of water is limited, and the dataset is incomplete. Therefore, after an extensive investigation on various data imputation methods’ performance in water and sediment datasets with different missing data rates, we chose the best imputation method to process the missing data. Afterwards, the water sediment sample will be tagged as one of four levels of pollution based on some guidelines and then the machine learning model will use a specific technique named classification to find the relationship between the data and the final result. After that, the result of prediction can be compared to the real result so that it can be checked whether the model is good and whether the prediction is accurate. Finally, the research gave improvement advice based on the result obtained from the model building part. Empirically, we show that our best model archives an accuracy of 75% after accounting for 57% of missing data. Experimentally, we show that our model would assist in automatically assessing water quality screening based on possibly incomplete real-world data

Security risks and user perception towards adopting Wearable Internet of Medical Things

The Wearable Internet of Medical Things (WIoMT) is a collective term for all wearable medical devices connected to the internet to facilitate the collection and sharing of health data such as blood pressure, heart rate, oxygen level, and more. Standard wearable devices include smartwatches and fitness bands. This evolving phenomenon due to the IoT has become prevalent in managing health and poses severe security and privacy risks to personal information. For better implementation, performance, adoption, and secured wearable medical devices, observing users’ perception is crucial. This study examined users’ perspectives of trust in the WIoMT while also exploring the associated security risks. Data analysed from 189 participants indicated a significant variance (R2 = 0.553) on intention to use WIoMT devices, which was determined by the significant predictors (95% Confidence Interval; p < 0.05) perceived usefulness, perceived ease of use, and perceived security and privacy. These were found to have important consequences, with WIoMT users intending to use the devices based on the trust factors of usefulness, easy to use, and security and privacy features. Further outcomes of the study identified how users’ security matters while adopting the WIoMT and provided implications for the healthcare industry to ensure regulated devices that secure confidential data

Organisational and individual behavioural susceptibility and protection approach for ransomware attacks

Ransomware attacks have become complex due to the ability of networked-systems constantly used as attack-vectors for propagating the ransomware payload to victims. The threat is socially engineered, making it difficult for victims to protect their data. Confidential information resources and assets are lost and rarely recovered in an attack resulting in financial losses amounting to millions of dollars. Ongoing research is exploring avenues to solve this problem including cybersecurity awareness and training from a singularised perspective, not pluralistic, to educate users of the consequences of their actions. The purpose of this study is to gain perceptions of several industries to develop insights on how to protect organisations from becoming victims of socially engineered ransomware attacks. Using a qualitative approach, critical themes on behavioural susceptibility to socially engineered ransomware were obtained, as well as the demand for applying behavioural theories and technical controls to develop effective training and education initiatives for resisting these attacks

A cloud based conceptual identity management model for secured Internet of Things operation

An era ago, projecting artificial intelligence as the pillar of next-generation technology would have been technically difficult. Today, machines are getting smarter, sparking a new wave of technology that resulted to Internet of Things (IoT). With IoT in play, individuals are able to connect more electronic devices other than smartphones and computers to the Internet. The vision is to create the possibility to manage electronic appliances via the Internet with the most minimal human intervention. IoT promises the application of computing to anything anywhere, and anyone at any time. Thus, it has been estimated that over 100 billion devices will be running the IoT model – drawing the power of cloud processing to create a massive network of devices that are bound to change the essential facets of life in various dimensions. However, several obstacles remain to fulfill this vision, among them is security concerns from an Identity of Things (IDoT) management perspective. IoT devices and users are already under cyber attacks, and any lapse in identity management will propagate these attacks. This paper examined how identity management for IoT is likely to play out in a world where the Internet and cloud technologies are expected to take center stage in the running of day-to-day activities. The paper analyses the identity of things challenges in IoT, followed by a proposal of cloud identity management model for IoT

Synthesis of evidence on existing and emerging social engineering ransomware attack vectors

As the threat landscape continues to evolve, users are becoming less aware, ignorant, or negligent, putting their confidential data at risk. Users easily fall prey to socially engineered ransomware attacks that encrypt and lock a computer or mobile device, holding it hostage unless a ransom is paid. The cryptoware encrypts data securely, making it almost impossible for anyone except the hacker to unlock the device. This research conducts a systematic review to identify methods for executing socially engineered ransomware attacks. Using a CRI framework, 122 studies were synthesized from 3209 research articles highlighting gaps in identifying and analyzing attack vectors, as well as the need for a holistic approach to ransomware with behavioural control as part of the solution. Human vulnerability was found to be a critical point of entry for miscreants seeking to spread ransomware. This review will be useful in developing control models that will educate organisations and security professionals to focus on adopting human-centered solutions to effectively counter ransomware attacks

Individual differences in cyber security behavior using personality-based models to predict susceptibility to sextortion attacks

The term sextortion is derived from the words sex and extortion. Extortion is about causing fear or threat in order to obtain something of value by the perpetrator. These threats could be to cause physical harm, commit a crime, or expose sensitive information (Lindgren, 1993). In the context of cyber sextortion, the threat is of the online release of explicit, intimate, or embarrassing sexual images in the absence of consent, in an attempt to procure additional images, money, or something of valuable nature to the attackers (Patchin & Hinduja, 2018). Cyber sextortion utilizes social engineering and phishing techniques as attack vectors, which has been considered a cyber security problem. In recent times, this problem has been growing, mostly due to the growth of internet technology: as technology increases so do the security threats (Gupta, Tewari, Jain, & Agrawal, 2017). According to the Australian government website Scamwatch, $933,470 was lost to phishing attacks in 2018. This is a huge increase from the$373,860 reported loss in 2016 (Australian Competition and Consumer Commission: ScamWatch, 2016). Although the number of reports remained steady from 2016 to 2018, there was still a significant increase in money lost. Due to the increasing use and reliance on technology, security threats to systems are relentlessly inventive (Gupta, Arachchilage, & Psannis, 2018). This further demonstrates that phishing is one of the most prevalent techniques for compromising personal and organizational information (Bailey, Mitchell, & Jensen, 2008). Given that cyber sextortion utilizes social engineering and phishing vectors, it is important to analyze cyber sextortion within the context of these vectors

A systematic approach to investigating how information security and privacy can be achieved in BYOD environments

Purpose-This paper's purpose is to provide a current best practice approach that can be used to identify and manage bring your own device (BYOD) security and privacy risks faced by organisations that use mobile devices as part of their business strategy. While BYOD deployment can provide work flexibility, boost employees' productivity and be cost cutting for organisations, there are also many information security and privacy issues, with some widely recognised, and others less understood. This paper focuses on BYOD adoption, and its associated risks and mitigation strategies, investigating how both information security and privacy can be effectively achieved in BYOD environments. Design/methodology/approach-This research paper used a qualitative research methodology, applying the case study approach to understand both organisational and employee views, thoughts, opinions and actions in BYOD environments. Findings-This paper identifies and understands BYOD risks, threats and influences, and determines effective controls and procedures for managing organisational and personal information resources in BYOD. Research limitations/implications-The scope of this paper is limited to the inquiry and findings from organisations operating in Australia. This paper also suggests key implications that lie within the ability of organisations to adequately develop and deploy successful BYOD management and practices. Originality/value-This paper expands previous research investigating BYOD practices, and also provides a current best practice approach that can be used by organisations to systematically investigate and understand how to manage security and privacy risks in BYOD environments

A policy-based framework for managing information security and privacy risks in BYOD environments

In a world where consumerisation of IT has driven individuals to acquire and use the latest technologies, an influx of employee personally owned devices has populated corporate environments. This phenomenon is known as Bring Your Own Device (BYOD). Managing organisational information resources has become increasingly complex with the concept of BYOD. Despite the perceived benefits of work flexibility, increased productivity, and efficiency of employees, BYOD raises many concerns relating to information security and privacy that can lead to confidential information loss. This prompts the demand for effective mobile device management tools, policies, standards and procedures. With most BYOD solutions failing to meet the requirement for holistic management of BYOD, this paper proposes a policy-based solution framework that organisations can adopt to achieve information security and privacy in BYOD environments