Information security is of vital importance to organizations. Breaches in security very often stem from behaviors of the system operator. Cyber misbehaviors on the part of employees can have devastating repercussions on the well-being of an organization. Up to now, research has mainly focused on how to protect information systems from outside attack, and only recently have researchers turned to the part the operator plays in keeping the systems safe. The present study investigated some individual differences that may play a role in people’s cyber behavior. The purpose of the study was to determine if locus of control was related to an individual’s perception of cyber risk and likelihood of engaging in cyber misbehaviors. Internal locus of control was found to be associated with higher perception of cyber risk, and higher cyber risk perception was found to lead to fewer cyber misbehaviors. The trait sensation seeking was also explored but no firm conclusions could be drawn from those results. Gaining an understanding of some of the differences between individuals that make some more likely to commit cyber misbehaviors-- as well as the dynamics behind these relationships—should be greatly beneficial in helping develop deterrents to cyber misbehavior and keeping information systems safer.

Digitization has been a growing phenomenon in today's society where organizations, individuals and society at large are affected by it. In pace with the emerging use of digitization,a realization of the relevance of cyber security in the public sector has increased, but not to a sufficient extent. Cyber security is about processes used to protect personal information and important data in organizations. Cyber security also includes knowledge of cyberattacks, where actors attack an organization's data most often for financial reasons. Cyber attacks have affected the public sector in several countries. The study focuses on known cyber attacks around the world that are related to public actors in healthcare, transport and electricity supply,among others. The study's analysis compares implemented measures after the incidents based on a cyber risk assessment framework. The survey shows that increased investments, new and clear work routines, training for employees and continuous testing of computer systems are important measures for the prevention of cyber attacks. The mentioned main actions that are common between the studied actors are supported by the theoretical frame of reference. This is because frameworks linked to cyber attacks also point out that investments, clear work routines and monitoring of systems contribute to protection against cyber attacks. / Digitalisering har varit ett växande fenomen i dagens samhälle där organisationer, individer och samhället i stort påverkas av det. Med takt av den framväxande användningen av digitalisering, har en realisering av cybersäkerhetens relevans inom den offentliga sektorn ökat, men inte i tillräcklig stor omfattning. Cybersäkerhet handlar om processer som används för att skydda personlig information och viktiga data i organisationer. Cybersäkerhet omfattar också kunskap om cyberattacker, där aktörer angriper en organisations data oftast för ekonomiska skäl. Cyberattacker har påverkat den offentliga sektorn i flera länder. Studien fokuserar på kända cyberangrepp runt om i världen som är relaterade till offentliga aktörer inom bland annat sjukvård, transport och elförsörjning. Studiens analys jämför genomförda åtgärder efter incidenterna utifrån ett ramverk om cyberriskbedömning. Undersökningen visar att ökade investeringar, nya och tydliga arbetsrutiner, utbildning till medarbetare ochkontinuerliga testningar av datasystem är viktiga åtgärder för förebyggande av cyberattacker.De nämnda huvudsakliga åtgärderna som är gemensamma mellan de studerade aktörerna stödjas av den teoretiska referensramen. Detta eftersom ramverk kopplade till cyberattacker påpekar också att investeringar, tydliga arbetsrutiner och övervakning av system, bidrar till skydd mot cyberattacker.

Användningen av molntjänster är utbredd bland företag idag, där den flexibilitet och tillgänglighet som erbjuds i molntjänster har påskyndat övergången från lokal datalagring och mjukvara. Tillämpningen av en tredjepartsleverantör för datalagring och användning av tjänster i molnet har skapat vissa farhågor om säkerhet och tillhörande risker. Därför syftar denna uppsats till att öka kunskapen om cybersäkerhet och tillhörande risker i molntjänster för användare och tjänsteleverantörer. För att uppnå det uttalade målet ställdes följande forskningsfråga: Vilka är säkerhetsriskerna i molntjänster idag, är det skillnad mellan molntjänstanvändare och molntjänstleverantörer i upplevda säkerhetsrisker? För att besvara forskningsfrågan har avhandlingen framför allt använt sig av tematisk analys av data som samlats in via semistrukturerade intervjuer och mailintervjuer. Intervjuerna har genomförts på ett urval av molntjänstleverantörer (två företag) och slutanvändare av molntjänster (två företag). Utifrån analysen av den insamlade empiriska datan fann avhandlingen att användare och leverantörer av molntjänster uppfattar insiderrisk som den mest kritiska säkerhetsrisken. För användare av molntjänster ansågs dataläckage, särskilt relaterat till kunddata, vara den högsta risken. Detta skiljer sig från molntjänstleverantörer, de är oroliga för konsekvenserna av ett dataläckage. För molntjänstleverantörer handlar det om att kunna visa att man tar en insider attack som en stor säkerhetsrisk och motarbetar den på ett förebyggande sätt för att öka förtroendet hos de företag som väljer att använda molntjänster. Samtidigt behövs fortsatt fokus på utvecklingen av säkerheten mot olika typer av hackerattacker och intrångsförsök som tas upp i studien för att inte försumma de säkerhetsrisker som ändå bör tas på allvar. / The use of cloud services is widespread among companies today, where the flexibility and availability offered in cloud services has sped up the transition from local data storage and software. The application of a third-party provider for data storage and the use of services in the cloud has created some concerns about security and associated risks. Therefore, this thesis aims to increase knowledge about cyber security and associated risks in cloud services for users and service providers. To achieve the stated aim the following research question was raised: What are the security risks in cloud services today, is there a difference between cloud service users and cloud service providers in perceived security risks? To answer the research question, the thesis predominantly made use of thematic analysis of data collected via semi-structured interviews and email-interviews. The interviews were conducted on a sample of cloud service providers (two companies) and end-users of cloud services (two companies). From the analysis of the collected empirical data, the thesis found out that cloud service users and providers perceive insider risk as the most critical security risk. For cloud service users, data leakage, particularly related to customer data, was considered to be the highest risk. This differs from cloud service providers; they are worried about the consequences of a data leakage.For cloud service providers, it is about being able to demonstrate that you take an insider attack as a major security risk and work against it in a preventive way in order to increase the trust of the companies that choose to use cloud services. At the same time, continued focus is needed on the development of security against various types of hacker attacks and intrusion attempts addressed in the study in order not to neglect the security risks that should still be taken seriously.

The master's thesis formulated the most important trends in the development of cybercrime in the banking sector. Based on the actual problems of cybersecurity management, a model for assessing cyber-risks for Russian commercial banks was reconstructed. / В магистерской диссертации сформулированы ключевые тенденции развития киберпреступности в банковском секторе. Исходя из актуальной проблематики управления кибербезопасностью, произведена реконструкция модели оценки кибер-рисков для российских коммерческих банков.

Due to a world-wide digitalisation, the fashion segment has experienced a shift from offline to online shopping. Consequently, more companies choose to interconnect digitally with consumers and suppliers. This highlights cyber risks and cybersecurity issues more than ever, which becomes specifically apparent amongst online companies. Through qualitative semi-structured interviews with three different Swedish online fashion companies, the purpose of investigating how cybersecurity currently is prioritised and managed was reached. In addition to this, two cybersecurity experts gave their view of the most important aspects in the field, which companies should consider. Results showed a fairly well-managed cybersecurity amongst Swedish online fashion companies, even though knowledge in the field is scarce. Through educating everyone at the company and implementing a group of people in charge of these questions, a more holistic view could be attained. By offering thoughts on how online fashion companies can enhance their current cybersecurity, this paper contributes to the literature of cyber risk management as well as provides meaningful knowledge to all types of online companies.

Much of the confusion about the effectiveness of information security programs concerns not only how to measure, but also what to measure — an issue of equivocality. Thus, to lower uncertainty for improved decision-making, it is first essential to reduce equivocality by defining, expanding, and clarifying risk factors so that metrics, the "necessary measures," can be unambiguously applied. We formulate a system that (1) allows threats to be accurately measured and tracked, (2) enables the impacts and costs of successful threats to be determined, and (3) aids in evaluating the effectiveness and return on investment of countermeasures. We then examine the quality of controls implemented to mitigate cyber risk and study how effectively they reduce the likelihood of security incidents. Improved control quality was shown to reduce the likelihood of security incidents, yet the results indicate that investing in maximum quality is not necessarily the most efficient use of resources. The next manuscript expands the discussion of cyber risk management beyond single organizations by surveying perceptions and experiences of risk factors related to 3rd parties. To validate and these findings, we undertake in an in-depth investigation of nearly 1000 real-world data breaches occurring over a ten-year period. It provides a robust data model and rich database required by a decision support system for cyber risk in the extended enterprise. To our knowledge, it is the most comprehensive field study ever conducted on the subject. Finally, we incorporate these insights, data, and factors into a simulation model that enables us study the transfer of cyber risk across different supply chain configurations and draw important managerial implications. / Ph. D. / This dissertation comprises several manuscripts exploring various topics under the overall theme of cybersecurity risk in supply chains. The first topic presents the difficulties involved in measuring risk in the cybersecurity domain and discusses how this hinders firms in making justified decisions and taking appropriate actions to manage risk. We then examine the quality of controls implemented to mitigate cyber risk and study how effectively they reduce the likelihood of security incidents. Next, we survey firms to explore perspectives and experiences related to security incidents involving their supply chain partners. To validate these perspectives, we then analyze data collected from over 900 forensic investigations of real-world breaches. This provides excellent visibility into how 3rd parties cause and contribute to incidents in supply chains and key risk factors. Finally, we incorporate these insights, data, and factors into a simulation model that enables us study the transfer of cyber risk across different supply chain configurations and draw important managerial implications.

Cyber risk or data breach risk can be estimated similarly as other types of operational risk. First we identify problems of cyber risk models in existing literature. A large dataset consisting of 5,713 loss events enables us to apply extreme value theory. We adopt goodness of fit tests adjusted for distribution functions with estimated parameters. These tests are often overlooked in the literature even though they are essential for correct results. We model aggregate losses in three different industries separately and then we combine them using a copula. A t-test reveals that potential one-year global losses due to data breach risk are larger than the GDP of the Czech Republic. Moreover, one-year global cyber risk measured with a 99% CVaR amounts to 2.5% of the global GDP. Unlike others we compare risk measures with other quantities which allows wider audience to understand the magnitude of the cyber risk. An estimate of global data breach risk is a useful indicator not only for insurers, but also for any organization processing sensitive data.