Yes / Cybersecurity is a serious issue that many organizations face these days. Therefore, cybersecurity management is very important for any organization. Organizations should learn to deal with these cyber threats through effective management across all business functions. The main purpose of this study is to identify the factors that affect cybersecurity within an organization and analyze relationships among these factors. The modified total interpretive structural modeling (M-TISM) technique is used to build a hierarchical model and define the common interactions between the factors. This study presents the impact of collaboration, training, resources and capabilities, information flow, technology awareness, and technological infrastructure on effective cybersecurity management. In addition, the study also explains the interrelationships among the identified factors in the M-TISM model.

Cybersecurity has become one of the most pressing issues facing society today. In particular, cybercriminals often congregate within online communities to exchange knowledge and assets. As a result, there has been a strong interest in recent years in developing a deeper understanding on cybercriminal behaviors, the global cybercriminal supply chain, emerging threats, and various other cybersecurity-related activities. However, few works in recent years have focused on identifying, collecting, and analyzing cybercriminal contents. Despite the high societal impact of cybercriminal community research, only a few studies have leveraged these rich data sources in their totality, and those that do often resort to manual data collection and analysis techniques. In this dissertation, I address two broad research questions: 1) In what ways can I advance cybersecurity as a science by scrutinizing the contents of online cybercriminal communities? and 2) How can I make use of computational methodologies to identify, collect, and analyze cybercriminal communities in an automated and scalable manner? To these ends, the dissertation comprises four essays. The first essay introduces a set of computational methodologies and research guidelines for conducting cybercriminal community research. To this point, there has been no literature establishing a clear route for non-technical and non-security researchers to begin studying such communities. The second essay examines possible motives for prolonged participation by individuals within cybercriminal communities. The third essay develops new neural network language model (NNLM) capabilities and applies them to cybercriminal community data in order to understand hacker-specific language evolution and to identify emerging threats. The last essay focuses on developing a NNLM-based framework for identifying information dissemination among varying international cybercriminal populations by examining multilingual cybercriminal forums. These essays help further establish cybersecurity as a science.

Doctor of Philosophy / Department of Computing and Information Sciences / Eugene Vasserman / Computer science departments face numerous challenges. Enrollment over the past 15 years reached an all-time high, endured a rapid decline and is now experiencing a just as rapid rebound. Meanwhile, demand for graduates continues to grow at an incredible rate. This is especially true in specialized sub-fields such as cybersecurity, where employers are constantly working to keep up with changing technology and new threats emerging on a daily basis. My research consists of two main objectives. The rst is gauging the ability of pre-service teachers from non-STEM areas of study to introduce and utilize computing concepts in a classroom setting. The second goal is to develop an assessment tool that enables improvements in quality of education for students within cybersecurity courses. Currently, few K-12 school districts in the United States o er stand-alone courses in computer science. My work shows that pre-service teachers in non-STEM areas are capable of effectively introducing basic concepts to students using modern software development tools while exploring content within their own areas of expertise. Survey results indicate that student interest and self-efficacy increased when they were taught by these pre-service teachers. I also found that with only 2 hours of experience, pre-service teachers enrolled in an education technology course showed dramatic increases in interest and confidence related to using this technology. These two findings demonstrate that there are potential ways to increase interest in computing among a broad student population at the K-12 level without changing core curriculum requirements. Even when students choose to enter computer science departments, a large number do not remain within the program. The second portion of my research focuses on developing an assessment tool for measuring student interest and self-efficacy in cybersecurity courses. Using information gleaned from a series of interviews with cybersecurity students, I developed, and performed the initial testing of, a survey instrument which measures these 2 values. Initial results show that the survey responses were very different between a group of introductory programming students and those enrolled in a cybersecurity course and that general trends in both self-efficacy and interest among theses differing student populations can be observed

Cybersecurity threats and vulnerabilities are causing substantial financial losses for governments and organizations all over the world. Cybersecurity criminals are stealing more than one billion dollars from banks every year by exploiting vulnerabilities caused by bank users' computer misuse. Cybersecurity breaches are threatening the common welfare of citizens since more and more terrorists are using cyberterrorism to target critical infrastructures (e.g., transportation, telecommunications, power, nuclear plants, water supply, banking) to coerce the targeted government and its people to accomplish their political objectives. Cyberwar is another major concern that nations around the world are struggling to get ready to fight. It has been found that intentional and unintentional users' misuse of information systems (IS) resources represents about 50% to 75% of cybersecurity threats and vulnerabilities to organizations. Computer Crime and Security Survey revealed that nearly 60% of security breaches occurred from inside the organization by users. Computer users are one of the weakest links in the information systems security chain, because users seem to have very limited or no knowledge of user computer self-efficacy (CSE), cybersecurity countermeasures awareness (CCA), and cybersecurity skills (CS). Users' CSE, CCA, and CS play an important role in users' computer misuse intention (CMI). CMI can be categorized as unauthorized access, use, disruption, modification, disclosure, inspection, recording, or destruction of information system data. This dissertation used a survey to empirically assess users' CSE, CCA, CS, and computer misuse intention (CMI) at government agencies. This study used Partial Least Square (PLS) technique to measure the fit of a theoretical model that includes seven independent latent variables (CSE, UAS-P, UAS-T, UAC-M, CCS, CIS, & CAS) and their influences on the dependent variable CMI. Also, PLS was used to examine if the six control variables (age, gender, job function, education level, length of working in the organization, & military status such as veteran) had any significant impact on CMI. This study included data collected from 185 employees of a local and state transportation agency from a large metropolitan in the northeastern United States. Participants received an email invitation to take the Web-based survey. PLS was used to test the four research hypotheses. The results of the PLS model showed that UAC-M and CIS were significant contributors (p

From factories to power grids, industrial systems are increasingly being digitally controlled and networked. While networking these systems together improves their efficiency and convenience, it also opens them up to attack by malicious actors. When these attacks occur, forensic investigators need to quickly be able to determine what was compromised and which corrective actions should be taken. In this thesis, a method is proposed for investigating attacks on industrial control systems by simulating the logged inputs of the system over time using a model constructed from the control programs that make up the system. When evaluated, this led to the detection of attacks which perturbed the normal operation of the system by comparing the simulated output to the actual output. It also allowed for dependency tracing between the inputs and outputs of the system, so that attacks could be traced from their unwanted effects to their source and vice-versa. This method can thus greatly aid investigators in recovering the complete attack story using only logs of inputs and outputs to an industrial control system.

La seguridad nacional y económica de los países depende del funcionamiento confiable de su infraestructura crítica. Las amenazas de ciberseguridad explotan la creciente complejidad de dichos sistemas, colocando la economía, la seguridad pública y la salud en riesgo. Al igual que el riesgo financiero y de reputación, el riesgo de ciberseguridad afecta a los objetivos estratégicos de una empresa. Puede aumentar los costos y afectar los ingresos. Puede dañar la capacidad de una organización para Innovar, brindar servicios, ganar y mantener a los clientes. Así mimo, la información se ha convertido en uno de los activos más importantes para cualquier organización, y el aseguramiento de la misma como un punto primordial para lograr ventajas competitivas y generación del valor, basando en el adecuado resguardo de la Confidencialidad, Disponibilidad e Integridad de la Información. El propósito del presente trabajo es desarrollar y proponer un método que permita gestionar la ciberseguridad en empresas del sector telecomunicaciones sobre la base de una adecuada gestión del riesgo y la medición de controles según un nivel de madurez. Este método propuesto se encuentra basado en el Cyber Security Framework (CSF) del National Institute of Standards and Technology (NIST) promulgada por el Presidente Obama mediante la Orden Ejecutiva (EO) 13636. / The national and economic security of the countries depends on the reliable operation of their critical infrastructure. Cybersecurity threats exploit the increasing complexity of these systems, putting the economy, public safety and health at risk. Like financial and reputation risk, cybersecurity risk affects the strategic objectives of a company. It can increase costs and affect income. It can damage the ability of an organization to innovate, provide services, earn and maintain customers. Likewise, information has become one of the most important assets for any organization, and the assurance of it as a fundamental point to achieve competitive advantages and generation of value, based on the appropriate protection of Confidentiality, Availability and Integrity of the information. The purpose of this paper is to develop and propose a method for managing cybersecurity in companies in the telecommunications sector on the basis of an adequate risk management and the measurement of controls according to a level of maturity. This proposed method is based on the Cyber Security Framework (CSF) of the National Institute of Standards and Technology (NIST) promulgated by President Obama through Executive Order (EO) 13636. / Trabajo de investigación

“The Freedom of Information Hacked: Console Cowboys, Computer Wizards, and Personal Freedom in the Digital Age” examines depictions of computer hackers in fiction, the media, and popular culture, assessing how such depictions both influence and reflect popular conceptions of hackers and what they do. In doing so, the dissertation demonstrates the central concerns of hacker stories—concerns about digital security, privacy, and the value of information—have become the concerns of digital culture as a whole, hackers laying bare collective hopes and fears regarding digital networks.

Despite technological advances in the information security field, attacks by unauthorized individuals and groups continue to penetrate defenses. Due to the rapidly changing environment of the Internet, the appearance of newly developed malicious software or attack techniques accelerates while security professionals continue in a reactive posture with limited time for identifying new threats. The problem addressed in this study was the perceived value of threat intelligence as a proactive process for information security. The purpose of this study was to explore how situation awareness is enhanced by receiving advanced intelligence reports resulting in better decision-making for proper response to security threats. Using a qualitative case study methodology a purposeful sample of 13 information security professionals were individually interviewed and the data analyzed through Nvivo 11 analytical software. The research questions addressed threat intelligence and its impact on the security analyst's cognitive situation awareness. Analysis of the data collected indicated that threat intelligence may enhance the security analyst's situation awareness, as supported in the general literature. In addition, this study showed that the differences in sources or the lack of an intelligence program may have a negative impact on determining the proper security response in a timely manner. The implications for positive social change include providing leaders with greater awareness through threat intelligence of ways to minimize the effects of cyber attacks, which may result in increasing business and consumer confidence in the protection of personal and confidential information.

A single cyberattack event involving 1 major corporation can cause severe business and social devastation. In this single case study, a major U.S. airline company was selected for exploration of the strategies information technology administrators and airline managers implemented to reduce the financial devastation that may be caused by a cyberattack. Seven participants, of whom 4 were airline managers and 3 were IT administrators, whose primary responsibility included implementation of strategies to plan for and respond to cyberattacks participated in the data collection process. This study was grounded on the general systems theory. Data collection entailed semistructured face-to-face and telephone interviews and collection and review of public documents. The data analysis process of this study involved the use of Yin's 5-step process of compiling, disassembling, reassembling, interpreting, and concluding, which provided a detailed analysis of the emerging themes. The findings produced results that identified strategies organizational managers and administrators of a U.S. airline implemented to reduce the fiscal influence of cyberattacks, such as proactive plans for education and training, active management, and an incident response plan. The findings of this study might affect social change by offering all individuals a perspective on creating effective cyberculture. An understanding of cyberculture could include the focus of a heightened understanding, whereby, to ensure the security of sensitive or privileged data and information and of key assets, thus, reducing the fiscal devastation that may be caused by cyberattacks.

This dissertation treats a variety of topics in the computer security domain which have direct impact on everyday life. The first extends false data injection attacks against state estimation in electric power grids and then provides a novel power flow model camouflage method to hamper these attacks. The second deals with automotive theft response, detailing a method for a car to intelligently identify when it has been stolen, based on collected behavioral traits of its driver. The third demonstrates a new attack against the content integrity of the PDF file format, caus- ing humans and computers to see different information within the same PDF documents. This dissertation lastly describes some future work efforts, identifying some potential vulnerabilities in the automated enforcement of copyright protection for audio (particularly music) in online systems such as YouTube.