New methods of conflict and coercion can prompt tectonic shifts in the international system, reconfiguring power, institutions, and norms of state behavior. Cyberattacks, coercive acts that disrupt or destroy the digital infrastructure on which states increasingly rely, have the potential to be such a tool — but only if put into practice. This study examines which forces in the international system might restrain state use of cyberattacks, even when they are militarily advantageous. To do so I place this novel technology in the context of existing international regimes, employing an analogical approach that identifies the salient aspects of cyberattacks, and compares them to prior weapons and tactics that share those attributes. Specifically, this study considers three possible restraints on state behavior: rationalist deterrence, the jus ad bellum regime governing the resort to force, and incompatibility with the jus in bello canon of law defining just conduct in war. First, I demonstrate that cyberattacks frustrate conventional deterrence models, and invite, instead, a novel form of proto-competition I call ‘structural deterrence.’ Recognizing that states have not yet grounded their sweeping claims about the acceptability of cyberattacks in any formal analysis, I consider evidence from other prohibited uses of force or types of weaponry to defining whether cyberattacks are ‘legal’ in peacetime or ‘usable’ in wartime. Whereas previous studies of cyberattacks have focused primarily on policy guidance for a single state or limited analysis of the letter of international law, this study explicitly relates international law to state decision-making and precedent. It draws together previously disparate literature across strategic studies, international law, and diplomatic history to offer conclusions applicable beyond any single technology, and of increasing importance as states’ dependence on technology grows.

Estimated worldwide losses due to cybercrime are approximately $375-575 billion annually, affecting governments, business organizations, economies, and society. With globalization on the rise, even small businesses conduct transactions worldwide through the use of information technology (IT), leaving these small businesses vulnerable to the intrusion of their networks. The purpose of this multiple case study was to explore the managerial strategies of small manufacturing business owners to protect their financial assets, data, and intellectual property from cybercrime. The conceptual framework was systems thinking and action theory. Participants included 4 small manufacturing business owners in the midwestern region of the United States. Data were collected via face-to-face interviews with owners, company documentation, and observations. Member checking was used to help ensure data reliability and validity. Four themes emerged from the data analysis: organizational policies, IT structure, managerial strategies, and assessment and action. Through effective IT security and protocols, proactive managerial strategies, and continuous evaluation of the organization's system, the small business owner can sustain the business and protect it against potential cyberattacks on the organization's network. The findings of the study have implications for positive social change by informing managers regarding (a) the elimination or reduction of cybercrimes, (b) the protection of customers' information, and (c) the prevention of future breaches by implementing effective managerial strategies to protect individuals in society.

En ces temps de pandémie Covid19, une énorme quantité de l’activité humaine est modifiée pour se faire à distance, notamment par des moyens électroniques. Cela rend plusieurs personnes et services vulnérables aux cyberattaques, d’où le besoin d’une éducation généralisée ou du moins accessible sur la cybersécurité. De nombreux efforts sont entrepris par les chercheurs, le gouvernement et les entreprises pour protéger et assurer la sécurité des individus contre les pirates et les cybercriminels. En raison du rôle important joué par les systèmes de recommandation dans la vie quotidienne de l'utilisateur, il est intéressant de voir comment nous pouvons combiner les systèmes de cybersécurité et de recommandation en tant que solutions alternatives pour aider les utilisateurs à comprendre les cyberattaques auxquelles ils peuvent être confrontés. Les systèmes de recommandation sont couramment utilisés par le commerce électronique, les réseaux sociaux et les plateformes de voyage, et ils sont basés sur des techniques de systèmes de recommandation traditionnels. Au vu des faits mentionnés ci-dessus, et le besoin de protéger les internautes, il devient important de fournir un système personnalisé, qui permet de partager les problèmes, d'interagir avec un système et de trouver des recommandations. Pour cela, ce travail propose « Cyberhelper », un système de recommandation de cybersécurité personnalisé basé sur des questions pour la sensibilisation à la cybersécurité. De plus, la plateforme proposée est équipée d'un algorithme hybride associé à trois différents algorithmes basés sur la connaissance, les utilisateurs et le contenu qui garantit une recommandation personnalisée optimale en fonction du modèle utilisateur et du contexte. Les résultats expérimentaux montrent que la précision obtenue en appliquant l'algorithme proposé est bien supérieure à la précision obtenue en utilisant d'autres mécanismes de système de recommandation traditionnels. Les résultats suggèrent également qu'en adoptant l'approche proposée, chaque utilisateur peut avoir une expérience utilisateur unique, ce qui peut l'aider à comprendre l'environnement de cybersécurité. / With the proliferation of the virtual universe and the multitude of services provided by the World Wide Web, a major concern arises: Security and privacy have never been more in jeopardy. Nowadays, with the Covid 19 pandemic, the world faces a new reality that pushed the majority of the workforce to telecommute. This thereby creates new vulnerabilities for cyber attackers to exploit. It’s important now more than ever, to educate and offer guidance towards good cybersecurity hygiene. In this context, a major effort has been dedicated by researchers, governments, and businesses alike to protect people online against hackers and cybercriminals. With a focus on strengthening the weakest link in the cybersecurity chain which is the human being, educational and awareness-raising tools have been put to use. However, most researchers focus on the “one size fits all” solutions which do not focus on the intricacies of individuals. This work aims to overcome that by contributing a personalized question-based recommender system. Named “Cyberhelper”, this work benefits from an existing mature body of research on recommender system algorithms along with recent research on non-user-specific question-based recommenders. The reported proof of concept holds potential for future work in adapting Cyberhelper as an everyday assistant for different types of users and different contexts.

No description available.

Användningen av cyberattacker mot organisationer, sjukvård och individer har ökat parallellt med digitaliseringen. Nationer har också blivit offer för dessa typer av attacker, som ofta kombineras med andra medel för krigföring såsom markanfall och missilattacker. En Cyber-Pearl Harbor (härefter förkortad CPH) är en term uppmärksammad av Leon Panetta som enligt honom består av kombinerade attacker som resulterar i mänsklig död, fysisk förstörelse och som lamslår en hel nation. Gazmend Huskaj använder sig av Panettas definition för utformande av ett ramverk (“DSLP-ramverket”) som är tänkt användas för att kunna klassificera en händelse som en CPH. Syftet med denna studie är att utforska om DSLP-ramverket kan valideras då termen har brukats de senaste 25 åren utan att en global definition tagit fäste, det är därför inte säkert att de kriterier som presenteras i ramverket överensstämmer med vad cybersäkerhetsexperter anser att en CPH är. Forskningsfrågan som utvecklades från denna studie blev följande: “Hur kan ramverket "DSLP-ramverk" från "Offensive Cyberspace Operations Targeting Ukraine: a Cyber Pearl-Harbor" (2023) valideras för klassificering av cyberattacker som Cyber Pearl-Harbor?”. En kvalitativ fallstudie genomfördes med en litteraturöversikt över termen CPH samt en semistrukturerad intervju där 3 experter utfrågades, vilket sedan analyserades via en tematisk analys. Som ett första steg för att besvara denna studies frågeställning applicerades ramverket på tre verkliga fall, detta för att avgöra huruvida dessa fall kan klassificeras som en CPH eller inte. Dessa tre verkliga fall var en attack mot en publik sjukvårdssektor i Costa Rica, ett TV-torn i Kiev, Ukraina samt dagligvarukedjan Coop i Sverige. Resultatet av valideringen av DSLP-ramverket var att endast fallet med TV-kornet i Kiev, Ukraina kunde klassificeras som en CPH. Den kognitiva effekten av eventet var dock inte förlamande nog att paralysera hela Ukraina, vilket gör klassificeringen diskutabel. Det andra steget bestod av en tematisk analys som gjordes på de tre experterna, vilket resulterade i skapandet av fyra huvudteman: Begreppets betydelse, Försvar mot Cyber-Pearl Harbor, Probabilitet och Kombinerade anfall. Följande slutsatser kom att dras i denna studie: Avsaknaden av en internationell/global standard gör det svårare att 1) göra upp om en gemensam definition av termen samt 2) klassificera en CPH i verklig kontext. Kombinationer av flera attacker och verktyg är en annan aspekt som understryks vid definiering av en CPH. Huruvida en CPH har skett eller inte varierar från expert till expert, och detsamma gäller probabiliteten för att en CPH kan ske i dagens kontext. Baserat på dessa slutsatser blir det svårt att validera DSLP-ramverket. Ytterligare forskning och data, intervjuer med experter och förtydligande behövs för att skapa en universell definition och därmed en gemensam grund att utgå ifrån. / The use of cyberattacks against organizations, health care and individuals have increased along with the constant digitalisation. Nations have also fallen victim to cyberattacks, often combined with other means of war like boots on the ground or missiles. A Cyber-Pearl Harbor (further shortened as CPH) is a term mentioned by Leon Panetta described in his words as “combined attacks that result in human death and physical destruction and that paralyzes an entire nation”. Gazmend Huskaj used Panettas definition in order to create a framework (“DSLP-framework”) for classifying an event as a CPH. This study strives to see if the DSLP-framework can be validated since the term has been widely used for the last 25 years, however a universal definition of the term seems to be missing, therefore it is not certain that the criterias presented in the framework is accurate to what cybersecurity experts consider a CPH to be. The research question developed from this study's problem became the following: “How can the framework “DSLP-Framework” from “Offensive Cyberspace Operations Targeting Ukraine: a Cyber Pearl-Harbor” (2023) be validated for classification of cyberattacks as Cyber Pearl-Harbor?”. A qualitative case study was conducted through a literature overview regarding the term CPH and a semistructured interview with three experts, which were later analyzed through a thematic analysis. As a first step to answering the research question, the framework was applied to three real life cases in order to determine whether or not they can be classified as a CPH. The following cases were an attack on a public health sector in Costa Rica, a TV-tower in Kyiv, Ukraine and the grocery company Coop in Sweden. The result from applying each case to the DSLP-framework was that only the case of the TV-tower in Kyiv could be classified as a CPH. However, the cognitive effects of the event were not crippling enough to paralyze the entirety of Ukraine, making the classification debatable. The second step was done through the use of thematic analysis on the interviews with the experts, in which four main themes were created: The meaning of the concept, Defense against Cyber-Pearl Harbor, Probability and Combined attacks. The following conclusions were drawn in this study: The absence of an international standard makes it harder to 1) conclude a common definition of the term and 2) classify a CPH in real context. The combinations of attacks and tools is another important aspect to highlight when defining a CPH. Whether a CPH has happened or not varies from expert to expert, and the same goes for the probability of a CPH occurring in today's context. Based on these conclusions, it is hard to validate the DSLP-framework. Further research and data, interviews with experts and clarification is needed in order to create a universal definition and therefore a common ground to start from.

The internet has become an essential part of most people's daily lives in recent years, and as more devices connect to the internet, the risk of cyber threats increases dramatically. As malware becomes more sophisticated, traditional security prevention measures are becoming less effective at defending from cyber attacks. As a result, Signature Based Detection and Anomaly Detection are two of many advanced techniques that have become crucial to defend against cyber threats such as malware, but even these are sometimes not enough to stop modern cyberattacks. In this literature review the goal is to discuss how trustworthy each of the mentioned malware detection techniques are at detecting malware in wireless networks. The study will measure trustworthiness by looking further into scalability, adaptability and robustness and resource consumption. This study concludes that both anomaly and signature-based malware detection methods exhibit strengths and weaknesses in scalability, robustness, adaptability, and resource consumption. Furthermore, more research is needed and as malware becomes more sophisticated and an increased threat to the world it is an area that is highly relevant.

Work from Home (WFH) gained momentum as a result of the pandemic. When large portions of the world were under government mandated lockdowns, and forced to institute WFH, companies began to slowly realize that the WFH model come with significant benefits such as the possibility to reduce office space or obtaining access to talent globally. Employees too are incentivized to WFH as it allows them more freedom in where to live, reduce commuting costs, and allow employees to space out work during the day and better manage energy levels. The thesis investigated cybersecurity and information security risks connected to the WFH model through collecting qualitative data by conducting a systematic literature review to gain background knowledge on the topic which was then used to create the interview guide that was used to carry out semi-structured interviews with four heterogeneous Swedish companies of various sizes, working in different fields. The SLR identified social engineering attacks in general, and phishing attacks in particular, to be the greatest threat to employees working in a WFH model suggesting employee security awareness training to be the key security measure in protecting the WFH model. The semi-structured interviews revealed that companies working in a WFH model have also drawn the same conclusion and have made significant efforts to raise security awareness through employee training programs.

<p>  </p> <p>Moving from high school to college is a major life transition leading to significant changes across many aspects of daily life. This time frame is often seen as the transition from a youth to a young adult, yet its impact on technology use and cybersecurity vulnerabilities remains relatively unstudied. This study investigated which factors associated with the first-year college transition are likely to increase vulnerability to cyberattacks in a sample of first-year college students attending a public university in the northeast United States, all of whom graduated from high school within the last 12 months. This study used a concurrent triangulation mixed methods design. A quantitative survey and qualitative semi-structured interviews were conducted concurrently, the methods were prioritized equally, and the results were interpreted together. Thematic analysis was used to analyze survey short answer responses and semi-structured interviews. A more descriptive analysis was completed to analyze survey responses from 38 respondents. The research found that an increase in the amount of time spent online, changing main internet activities, and lack of cybersecurity awareness training are factors which are likely to increase vulnerability to cyber threats during the transition from high school to college. </p>

Integration of a cyber system and communication systems with the traditional power grid has enabled better monitoring and control of the smart grid making it more reliable and resilient. This empowers the system operators to make informed decisions as a result of better system visibility. The grid has moved from a completely air-gapped structure to a well-connected network. However, this remote-control capability to control distributed physical components in a distribution system can be exploited by adversaries with malicious intent to disrupt the power supply to the customers. Therefore, while taking advantage of the cyber-physical posture in the smart grid for improved controllability, there is a critical need for cybersecurity research to protect the critical power infrastructure from cyberattacks. While the literature regarding cybersecurity in distribution systems has focused on detecting and mitigating the cyberattack impact on the physical system, there has been limited effort towards a preventive approach for detecting cyberattacks. With this in mind, this dissertation focuses on developing intelligent solutions to detect cyberattacks in the cyber layer of the distribution grid and prevent the attack from impacting the physical grid. There has been a particular emphasis on the impact of coordinated attacks and the design of proactive defense to detect the attacker's intent to predict the attack trajectory. The vulnerability assessment of the cyber-physical system in this work identifies the key areas in the system that are prone to cyberattacks and failure to detect attacks timely can lead to cascading outages. A comprehensive cyber-physical system is developed to deploy different intrusion detection solutions and quantify the effect of proactive detection in the cyber layer. The attack detection approach is driven by artificial intelligence to learn attack patterns for effective attack path prediction in both a fully observable and partially observable distribution system. The role of effective communication technology in attack detection is also realized through detailed modeling of 5G and latency requirements are validated. / Doctor of Philosophy / The traditional power grid was designed to supply electricity from the utility side to the customers. This grid model has shifted from a one-directional supply of power to a bi-directional one where customers with generation capacity can provide power to the grid. This is possible through bi-directional data flow which ensures the complete power system observability and allows the utility to monitor and control distributed power components remotely. This connectivity depends on the cyber system and efficient communication for ensuring stable and reliable system operations. However, this also makes the grid vulnerable to cyberattacks as the traditional air-gapped grid has evolved into a highly connected network, thus increasing the attack surface for attackers. They might pose the capability to intrude on the network by exploiting network vulnerability, move laterally through different aspects of the network, and cause operational disruption. The type of disruption can be minor voltage fluctuations or even widespread power outages depending on the ultimate malicious attack goal of such adversaries. Therefore, cybersecurity measures for protecting critical power infrastructure are extremely important to ensure smooth system operations. There has been recent research effort for detecting such attacks, isolating the attacked parts in the grid, and mitigating the impact of the attack, however, instead of a passive response there is a need for a preventive or proactive detection mechanism. This can ensure capturing the attack at the cyber layer before intruders can impact the physical grid. This is the primary motivation to design an intrusion detection system that can detect different coordinated attacks (where different attacks are related and directed towards a specific goal) and can predict the attack path. This dissertation focuses on first identifying the vulnerabilities in the distribution system and a comprehensive cyber-physical system is developed. Different detection algorithms are developed to detect cyberattacks in the distribution grid and have the intelligence to learn the attack patterns to successfully predict the attack path. Additionally, the effectiveness of advanced communication such as 5G is also tested for different system operations in the distribution system.

The landscape of vehicular transportation is quickly shifting as emerging technologies continue to increase in intelligence and complexity. From the introduction of Intelligent Transportation Systems (ITS) to the quickly developing field of Connected and Autonomous Vehicles (CAVs), the transportation industry is experiencing a shift in focus. A move to more autonomous and intelligent transportation systems brings with it a promise of increased equity, efficiency, and safety. However, one aspect that is overlooked in this shift is cybersecurity. As intelligent systems and vehicles have been introduced, a large amount of research has been conducted showing vulnerabilities in them. With a new connected transportation system emerging, a multidisciplinary approach will be required to develop a cyber-resilient network. Ensuring protection against cyberattacks and developing a system that can handle their consequences is a key objective moving forward. The first step to developing this system is understanding how different cyberattacks can negatively impact the operations of the transportation system. This research aimed to quantify the safety and efficiency impacts of an attack on the transportation network. To do so, a simulation was developed using Veins software to model a network of intelligent intersections in an urban environment. Vehicles communicated with Road-Side Units (RSUs) to make intersection reservations – effectively simulating CAV vehicle network. Denial of Service (DoS) and Man in the Middle (MITM) attacks were simulated by dropping and delaying vehicle's intersection reservation requests, respectively. Attacks were modeled with varying degrees of severity by changing the number of infected RSUs in the system and their attack success rates. Data analysis showed that severe attacks, either from a DoS or MITM attack, can have significant impact on the transportation network's operations. The worst-case scenario for each introduced an over 20% increase in delay per vehicle. The simulation showed also that increasing the number of compromised RSUs directly related to decreased safety and operational efficiency. Successful attacks also produced a high level of variance in their impact. One other key finding was that a single compromised RSU had very limited impact on the transportation network. These findings highlight the importance of developing security and resilience in a connected vehicle environment. Building a network that can respond to an initial attack and prevent an attack's dissemination through the network is crucial in limiting the negative effects of the attack. If proper resilience planning is not implemented for the next generation of transportation, adversaries could cause great harm to safety and efficiency with relative ease. The next generation of vehicular transportation must be able to withstand cyberattacks to function. Understanding their impact is a key first step for engineers and planners on the long road to ensuring a secure transportation network. / Master of Science / The landscape of transportation is quickly shifting as transportation technologies continue to increase in intelligence and complexity. The transportation industry is shifting its focus to Connected and Autonomous Vehicles (CAVs). The move to more autonomous and intelligent transportation systems brings with it a promise of increased transportation equity, efficiency, and safety. However, one aspect that is often overlooked in this shift is cybersecurity. As intelligent systems and vehicles have been introduced, a large amount of research has been conducted showing cyber vulnerabilities in them. With a new connected transportation system emerging, a multidisciplinary approach will be required to prevent and handle attacks. Ensuring protection against cyberattacks is a key objective moving forward. The first step to developing this system is understanding how different cyberattacks can negatively impact the operations of the transportation system. This research aimed to measure the safety and efficiency impacts of an attack on the transportation network. To do so, a simulation was developed to model an intelligent urban road network. Vehicles made reservations at each intersection they passed – effectively simulating an autonomous vehicle network. Denial of Service (DoS) and Man in the Middle (MITM) attacks were simulated by dropping, and delaying vehicle's intersection reservation requests, respectively. These cyberattacks were modeled with varying degrees of severity to test the different impacts on the transportation network. Analysis showed that severe attacks can have significant impact on the transportation network's operations. The worst-case scenario for each attack introduced an over 20% increase in delay per vehicle. The simulation showed also that increasing the number of attacked intersections directly related to decreased safety and operational efficiency. Successful attacks also produced a high level of variance in their impact. One other key finding was that a single compromised RSU had very limited impact on the transportation network. These findings highlight the importance of developing security and resilience in a connected vehicle environment. Building a transportation network that can respond to an initial attack and prevent it from impacting the entire network is crucial in limiting the negative effects of the attack. If proper resilience planning is not implemented for CAVs, hackers could cause great harm to safety and efficiency with relative ease. The next generation of vehicular transportation must be able to withstand cyberattacks to function. Understanding their impact is a key first step for engineers and planners on the long road to ensuring a secure transportation network.