Cyber risk and cybersecurity: a systematic review of data availability.
Ontology highlight
ABSTRACT: Supplementary information
The online version contains supplementary material available at 10.1057/s41288-022-00266-6.
SUBMITTER: Cremer F
PROVIDER: S-EPMC8853293 | biostudies-literature | 2022
REPOSITORIES: biostudies-literature
Publications
Cyber risk and cybersecurity: a systematic review of data availability.
Cremer Frank F Sheehan Barry B Fortmann Michael M Kia Arash N AN Mullins Martin M Murphy Finbarr F Materne Stefan S
The Geneva papers on risk and insurance. Issues and practice 20220217 3
Cybercrime is estimated to have cost the global economy just under USD 1 trillion in 2020, indicating an increase of more than 50% since 2018. With the average cyber insurance claim rising from USD 145,000 in 2019 to USD 359,000 in 2020, there is a growing necessity for better cyber information sources, standardised databases, mandatory reporting and public awareness. This research analyses the extant academic and industry literature on cybersecurity and cyber risk management with a particular f ...[more]
Similar Datasets
Project description:BackgroundHealthcare is facing a growing threat of cyberattacks. Myriad data sources illustrate the same trends that healthcare is one of the industries with the highest risk of cyber infiltration and is seeing a surge in security incidents within just a few years. The circumstances thus begged the question: are US hospitals prepared for the risks that accompany clinical medicine in cyberspace?ObjectiveThe study aimed to identify the major topics and concerns present in today's hospital cybersecurity field, intended for non-cyber professionals working in hospital settings.MethodsVia structured literature searches of the National Institutes of Health's PubMed and Tel Aviv University's DaTa databases, 35 journal articles were identified to form the core of the study. Databases were chosen for accessibility and academic rigor. Eighty-seven additional sources were examined to supplement the findings.ResultsThe review revealed a basic landscape of hospital cybersecurity, including primary reasons hospitals are frequent targets, top attack methods, and consequences hospitals face following attacks. Cyber technologies common in healthcare and their risks were examined, including medical devices, telemedicine software, and electronic data. By infiltrating any of these components of clinical care, attackers can access mounds of information and manipulate, steal, ransom, or otherwise compromise the records, or can use the access to catapult themselves to deeper parts of a hospital's network. Issues that can increase healthcare cyber risks, like interoperability and constant accessibility, were also identified. Finally, strategies that hospitals tend to employ to combat these risks, including technical, financial, and regulatory, were explored and found to be weak. There exist serious vulnerabilities within hospitals' technologies that many hospitals presently fail to address. The COVID-19 pandemic was used to further illustrate this issue.ConclusionsComparison of the risks, strategies, and gaps revealed that many US hospitals are unprepared for cyberattacks. Efforts are largely misdirected, with external-often governmental-efforts negligible. Policy changes, e.g., training employees in cyber protocols, adding advanced technical protections, and collaborating with several experts, are necessary. Overall, hospitals must recognize that, in cyber incidents, the real victims are the patients. They are at risk physically and digitally when medical devices or treatments are compromised.
| S-EPMC9403058 | biostudies-literature
Project description:BackgroundCyber threats are increasing across all business sectors, with health care being a prominent domain. In response to the ever-increasing threats, health care organizations (HOs) are enhancing the technical measures with the use of cybersecurity controls and other advanced solutions for further protection. Despite the need for technical controls, humans are evidently the weakest link in the cybersecurity posture of HOs. This suggests that addressing the human aspects of cybersecurity is a key step toward managing cyber-physical risks. In practice, HOs are required to apply general cybersecurity and data privacy guidelines that focus on human factors. However, there is limited literature on the methodologies and procedures that can assist in successfully mapping these guidelines to specific controls (interventions), including awareness activities and training programs, with a measurable impact on personnel. To this end, tools and structured methodologies for assisting higher management in selecting the minimum number of required controls that will be most effective on the health care workforce are highly desirable.ObjectiveThis study aimed to introduce a cyber hygiene (CH) methodology that uses a unique survey-based risk assessment approach for raising the cybersecurity and data privacy awareness of different employee groups in HOs. The main objective was to identify the most effective strategy for managing cybersecurity and data privacy risks and recommend targeted human-centric controls that are tailored to organization-specific needs.MethodsThe CH methodology relied on a cross-sectional, exploratory survey study followed by a proposed risk-based survey data analysis approach. First, survey data were collected from 4 different employee groups across 3 European HOs, covering 7 categories of cybersecurity and data privacy risks. Next, survey data were transcribed and fitted into a proposed risk-based approach matrix that translated risk levels to strategies for managing the risks.ResultsA list of human-centric controls and implementation levels was created. These controls were associated with risk categories, mapped to risk strategies for managing the risks related to all employee groups. Our mapping empowered the computation and subsequent recommendation of subsets of human-centric controls to implement the identified strategy for managing the overall risk of the HOs. An indicative example demonstrated the application of the CH methodology in a simple scenario. Finally, by applying the CH methodology in the health care sector, we obtained results in the form of risk markings; identified strategies to manage the risks; and recommended controls for each of the 3 HOs, each employee group, and each risk category.ConclusionsThe proposed CH methodology improves the CH perception and behavior of personnel in the health care sector and provides risk strategies together with a list of recommended human-centric controls for managing a wide range of cybersecurity and data privacy risks related to health care employees.
| S-EPMC10415935 | biostudies-literature
Project description:Deviance is a complex phenomenon that influences aspects both at the macro and micro levels, extensively studied by social scientists The main objective of this article was to conduct a systematic literature review for clustering the topics on adolescent deviance and online deviance. Grounded in Pickering's and Byrne's guidelines and PRISMA protocol, we identified the most recurrent themes, theories and predictors in the 61 most-cited articles related to the concept of deviance from the database of Web of Science, as well as in 488 abstracts of representative papers. The results emphasized four main clusters of topics, namely, predictors of deviance, online deviance, socio-constructivist theories, and research based theories of deviant behavior. The findings highlighted that researchers frequently use strain theory, social learning, self-control, and social control theories in their studies. Our systematic literature review revealed also the most encountered predictors of deviance, which we have classified into five main categories: family patterns, socio-demographic aspects, socialization, victimization, and school and individual factors. For online deviance, family patterns, socio-demographic aspects, victimization, school and individual factors, and Internet and computer use have been determined to be the main groups of predictors. The present systematic literature review makes an important contribution to the understanding of deviance by presenting an overview of the phenomenon.
| S-EPMC8546304 | biostudies-literature
Project description:Cyber-aggression is global epidemic affecting citizens of cyberspace, without regards to physical, geographical and time constraints. Recent research has identified the significant role of cyber-bystanders in exacerbating and de-escalating incidents on cyber-aggression they come across. Additionally, frequent exposure to cyber-aggression is found to have been associated with negative effects on participants of cyber-aggression, ranging from self-esteem problems to mental health disorders such as depression and anxiety, and in the worst cases even suicidal behaviors and ideation. Moreover, past research had also identified that negative bystanders could potentially become aggressors themselves. Therefore, the current review is aimed at uncovering the common themes and factors that drive individuals to resort to negative bystander behavior. Hence, a systematic literature review using the PRISMA framework was carried out, involving articles published between January 2012 to March 2022, on online databases such as SCOPUS, Science Direct, SAGE Journals, Web of Science, and Springer Link. Results obtained through the synthesis of 27 selected articles, were grouped into three categories, namely situational factors, personal factors and social influence. Upon further synthesis of the results, it was noted that many of the factors had interacted with each other. Thus, practical suggestion for prevention and future research would include addressing these interactions in preventative methodologies and research interests.
| S-EPMC9574391 | biostudies-literature
Project description:Cyberattacks pose a significant business risk to organizations. Although there is ample literature focusing on why people pose a major risk to organizational cybersecurity and how to deal with it, there is surprisingly little we know about cyber and information security decision-makers who are essentially the people in charge of setting up and maintaining organizational cybersecurity. In this paper, we study cybersecurity awareness of cyber and information security decision-makers, and investigate factors associated with it. We conducted an online survey among Slovenian cyber and information security decision-makers (N = 283) to (1) determine whether their cybersecurity awareness is associated with adoption of antimalware solutions in their organizations, and (2) explore which organizational factors and personal characteristics are associated with their cybersecurity awareness. Our findings indicate that awareness of well-known threats and solutions seems to be quite low for individuals in decision-making roles. They also provide insights into which threats (e.g., distributed denial-of-service (DDoS) attacks, botnets, industrial espionage, and phishing) and solutions (e.g., security operation center (SOC), advanced antimalware solutions with endpoint detection and response (EDR)/extended detection and response (XDR) capabilities, organizational critical infrastructure access control, centralized device management, multi-factor authentication, centralized management of software updates, and remote data deletion on lost or stolen devices) are cyber and information security decision-makers the least aware of. We uncovered that awareness of certain threats and solutions is positively associated with either adoption of advanced antimalware solutions with EDR/XDR capabilities or adoption of SOC. Additionally, we identified significant organizational factors (organizational role type) and personal characteristics (gender, age, experience with information security and experience with information technology (IT)) related to cybersecurity awareness of cyber and information security decision-makers. Organization size and formal education were not significant. These results offer insights that can be leveraged in targeted cybersecurity training tailored to the needs of groups of cyber and information security decision-makers based on these key factors.
| S-EPMC11488713 | biostudies-literature
Project description:BACKGROUND:Cybersecurity incidents are a growing threat to the health care industry in general and hospitals in particular. The health care industry has lagged behind other industries in protecting its main stakeholder (ie, patients), and now hospitals must invest considerable capital and effort in protecting their systems. However, this is easier said than done because hospitals are extraordinarily technology-saturated, complex organizations with high end point complexity, internal politics, and regulatory pressures. OBJECTIVE:The purpose of this study was to develop a systematic and organizational perspective for studying (1) the dynamics of cybersecurity capability development at hospitals and (2) how these internal organizational dynamics interact to form a system of hospital cybersecurity in the United States. METHODS:We conducted interviews with hospital chief information officers, chief information security officers, and health care cybersecurity experts; analyzed the interview data; and developed a system dynamics model that unravels the mechanisms by which hospitals build cybersecurity capabilities. We then use simulation analysis to examine how changes to variables within the model affect the likelihood of cyberattacks across both individual hospitals and a system of hospitals. RESULTS:We discuss several key mechanisms that hospitals use to reduce the likelihood of cybercriminal activity. The variable that most influences the risk of cyberattack in a hospital is end point complexity, followed by internal stakeholder alignment. Although resource availability is important in fueling efforts to close cybersecurity capability gaps, low levels of resources could be compensated for by setting a high target level of cybersecurity. CONCLUSIONS:To enhance cybersecurity capabilities at hospitals, the main focus of chief information officers and chief information security officers should be on reducing end point complexity and improving internal stakeholder alignment. These strategies can solve cybersecurity problems more effectively than blindly pursuing more resources. On a macro level, the cyber vulnerability of a country's hospital infrastructure is affected by the vulnerabilities of all individual hospitals. In this large system, reducing variation in resource availability makes the whole system less vulnerable-a few hospitals with low resources for cybersecurity threaten the entire infrastructure of health care. In other words, hospitals need to move forward together to make the industry less attractive to cybercriminals. Moreover, although compliance is essential, it does not equal security. Hospitals should set their target level of cybersecurity beyond the requirements of current regulations and policies. As of today, policies mostly address data privacy, not data security. Thus, policy makers need to introduce policies that not only raise the target level of cybersecurity capabilities but also reduce the variability in resource availability across the entire health care system.
| S-EPMC5996174 | biostudies-literature
Project description:HIV-1 pol sequences from antiretroviral therapy (ART)-naive and ART-experienced people living with HIV-1 are fundamental to understanding the genetic correlates and epidemiology of HIV-1 drug resistance (HIVDR). To assess the public availability of HIV-1 pol sequences and ART histories of the individuals from whom sequenced viruses were obtained, we performed a systematic review of PubMed and GenBank for HIVDR studies published between 2010 and 2019 that reported HIV-1 pol sequences. 934 studies met inclusion criteria, including 461 studies of ART-naive adults, 407 of ART-experienced adults, and 66 of ART-naive and ART-experienced children. Sequences were available for 317 (68·8%) studies of ART-naive individuals, 190 (46·7%) of ART-experienced individuals, and 45 (68·2%) of children. Among ART-experienced individuals, sequences plus linked ART histories were available for 82 (20·1%) studies. Sequences were available for 21 (29·2%) of 72 clinical trials. Among journals publishing more than ten studies, the proportion with available sequences ranged from 8·3% to 86·9%. Strengthened implementation of data sharing policies is required to increase the number of studies with available HIVDR data to support the enterprise of global ART in the face of emerging HIVDR.
| S-EPMC9095989 | biostudies-literature
Project description:Real-world evidence (RWE) is emerging as a fundamental component of the post-marketing evaluation of medicinal products. Even though the focus on RWE studies has increased in Colombia, the availability of secondary data sources to perform this type of research is not well documented. Thus, we aimed at identifying and characterizing secondary data sources available in Colombia. We performed a systematic literature review on PubMed, EMBASE, and VHL using a combination of controlled vocabulary and keywords for the concepts of electronic health records, epidemiologic studies and Colombia. A total of 323 publications were included. These comprised 123 identified secondary data sources including pharmacy dispensing databases, government datasets, disease registries, insurance databases, and electronic heath records, among others. These data sources were mostly used for cross-sectional studies focused on disease epidemiology in a specific population. Almost all databases (95%) contained demographic information, followed by pharmacological treatment (44%) and diagnostic tests (39%). Even though the database owner was identifiable in 94%, access information was only available in 44% of the articles. Only a pharmacy-dispensing database, local cancer registries, and government databases included a description regarding the quality of the information available. The diversity of databases identified shows that Colombia has a high potential to continue enhancing its RWE strategy. Greater efforts are required to improve data quality and accessibility. The linkage between databases will expand data pooling and integration to boost the translational potential of RWE.
| S-EPMC7510335 | biostudies-literature
Project description:The research on using process mining in learning analytics of cybersecurity exercises relies on datasets that reflect the real behavior of trainees. Although modern cyber ranges, in which training sessions are organized, can collect behavioral data in the form of event logs, the organization of such exercises is laborious. Moreover, the collected raw data has to be processed and transformed into a specific format required by process mining techniques. We present two datasets with slightly different characteristics. While the first exercise with 52 participants was not limited in time, the second supervised exercise with 42 trainees lasted two hours. Also, the cybersecurity tasks were slightly different. A total of 11757 events were collected. Of these, 3597 were training progress events, 5669 were Bash commands, and 2491 were Metasploit commands. Joint CSV files distilled from the raw event data can be used as input for existing process mining tools.
| S-EPMC10770710 | biostudies-literature
Project description:Cyber-physical systems embed software into the physical world. They appear in a wide range of applications such as smart grids, robotics, and intelligent manufacturing. Cyber-physical systems have proved resistant to modeling due to their intrinsic complexity arising from the combination of physical and cyber components and the interaction between them. This study proposes a general framework for discovering cyber-physical systems directly from data. The framework involves the identification of physical systems as well as the inference of transition logics. It has been applied successfully to a number of real-world examples. The novel framework seeks to understand the underlying mechanism of cyber-physical systems as well as make predictions concerning their state trajectories based on the discovered models. Such information has been proven essential for the assessment of the performance of cyber-physical systems; it can potentially help debug in the implementation procedure and guide the redesign to achieve the required performance.
| S-EPMC6814766 | biostudies-literature