In general, people are poorly protected against cyberthreats, with the main reason being user behaviour. For the study described in this paper, a ques-tionnaire was developed in order to understand how people’s knowledge of and attitude towards both cyberthreats and cyber security controls affect in-tention to adopt cybersecure behaviour. The study divides attitude into a cog-nitive and an affective component. Although only the cognitive component of attitude is usually studied, the results from a questionnaire of 300 respond-ents show that both the affective and cognitive components of attitude have a clearly positive, albeit varying, influence on behavioural intention, with the affective component having an even greater effect on attitude than the cog-nitive aspect. No correlation was found between knowledge and behavioural intention. The results indicate that attitude is an important factor to include when developing behavioural interventions, but also that different kinds of attitude should be addressed differently in interventions.
DOCUMENT
Adversarial thinking is essential when dealing with cyber incidents and for finding security vulnerabilities. Capture the Flag (CTF) competitions are used all around the world to stimulate adversarial thinking. Jeopardy-style CTFs, given their challenge-and-answer based nature, are used more and more in cybersecurity education as a fun and engaging way to inspire students. Just like traditional written exams, Jeopardy-style CTFs can be used as summative assessment. Did a student provide the correct answer, yes or no. Did the participant in the CTF competition solve the challenge, yes or no. This research project provides a framework for measuring the learning outcomes of a Jeopardy-style CTF and applies this framework to two CTF events as case studies. During these case studies, participants were tested on their knowledge and skills in the field of cybersecurity and queried on their attitude towards CTF education. Results show that the main difference between traditional written exam and a Jeopardy-style CTF is the way in which questions a re formulated. CTF education is stated to be challenging and fun because questions are formulated as puzzles that need to be solved in a gamified and competitive environment. Just like traditional written exams, no additional insight into why the participant thinks the correct answer is the correct answer has been observed or if the participant really did learn anything new by participating. Given that the main difference between a traditional written exam and a Jeopardy-style CTF is the way in which questions are formulated, learning outcomes can be measured in the same way. We can ask ourselves how many participants solved which challenge and to which measurable statements about “knowledge, skill and attitude” in the field of cybersecurity each challenge is related. However, when mapping the descriptions of the quiz-questions and challenges from the two CTF events as case studies to the NICE framework on Knowledge, Skills and Abilities in cybersecurity, the NICE framework did not provide us with detailed measurable statements that could be used in education. Where the descriptions of the quiz-questions and challenges were specific, the learning outcomes of the NICE framework are only formulated in a quite general matter. Finally, some evidence for Csíkszentmihályi’s theory of Flow has been observed. Following the theory of Flow, a person can become fully immersed in performing a task, also known as “being in the zone” if the “challenge level” of the task is in line with the person’s “skill level”. The persons mental state towards a task will be different depending on the challenge level of the task and required skill level for completing it. Results show that participants state that some challenges were difficult and fun, where other challenges were easy and boring. As a result of this9 project, a guide / checklist is provided for those intending to use CTF in education.
DOCUMENT
Slachtofferschap van ransomware – software die bestanden of systemen versleutelt als drukmiddel om slachtoffers losgeld te laten betalen – is een groeiend probleem voor bedrijven in Nederland. Tot wel 17% van de Nederlandse mkb’ers zegt ooit slachtoffer te zijn geworden van dit delict. Toch nemen ondernemers nog te weinig maatregelen om hun bedrijf tegen ransomware en andere vormen van cybercriminaliteit te beschermen. Hoe kunnen we de weerbaarheid van het mkb vergroten?
DOCUMENT
The growing sophistication, frequency and severity of cyberattacks targeting all sectors highlight their inevitability and the impossibility of completely protecting the integrity of critical computer systems. In this context, cyber-resilience offers an attractive alternative to the existing cybersecurity paradigm. We define cyber-resilience as the capacity to withstand, recover from and adapt to the external shocks caused by cyber-risks. This article seeks to provide a broader organizational understanding of cyber-resilience and the tensions associated with its implementation. We apply Weick's (1995) sensemaking framework to examine four foundational tensions of cyber-resilience: a definitional tension, an environmental tension, an internal tension, and a regulatory tension. We then document how these tensions are embedded in cyber-resilience practices at the preparatory, response and adaptive stages. We rely on qualitative data from a sample of 58 cybersecurity professionals to uncover these tensions and how they reverberate across cyber-resilience practices.
DOCUMENT
NL samenvatting: In dit verkennend onderzoek werden social engineering-aanvallen bestudeerd, vooral de aanvallen die mislukten, om organisaties te helpen weerbaarder te worden. Fysieke, telefonische en digitale aanvallen werden uitgevoerd met behulp van een script volgens de 'social engineering-cyclus'. We gebruikten het COM-B model van gedragsverandering, verfijnd door het Theoretical Domains Framework, om door middel van een enquête te onderzoeken hoe Capability, Motivational en vooral Opportunity factoren helpen om de weerbaarheid van organisaties tegen social engineering-aanvallen te vergroten. Binnen Opportunity leek sociale invloed van extra belang. Werknemers die in kleine ondernemingen werken (<50 werknemers) waren succesvoller in het weerstaan van digitale social engineering-aanvallen dan werknemers die in grotere organisaties werken. Een verklaring hiervoor zou een grotere mate van sociale controle kunnen zijn; deze medewerkers werken dicht bij elkaar, waardoor ze in staat zijn om onregelmatigheden te controleren of elkaar te waarschuwen. Ook het installeren van een gespreksprotocol over hoe om te gaan met buitenstaanders was een maatregel die door alle organisaties werd genomen waar telefonische aanvallen faalden. Daarom is het moeilijker voor een buitenstaander om toegang te krijgen tot de organisatie door middel van social engineering. Dit artikel eindigt met een discussie en enkele aanbevelingen voor organisaties, bijvoorbeeld met betrekking tot het ontwerp van de werkomgeving, om hun weerbaarheid tegen social engineering-aanvallen te vergroten. ENG abstract: In this explorative research social engineering attacks were studied, especially the ones that failed, in order to help organisations to become more resilient. Physical, phone and digital attacks were carried out using a script following the ‘social engineering cycle’. We used the COM-B model of behaviour change, refined by the Theoretical Domains Framework, to examine by means of a survey how Capability, Motivational and foremost Opportunity factors help to increase resilience of organisations against social engineering attacks. Within Opportunity, social influence seemed of extra importance. Employees who work in small sized enterprises (<50 employees) were more successful in withstanding digital social engineering attacks than employees who work in larger organisations. An explanation for this could be a greater amount of social control; these employees work in close proximity to one another, so they are able to check irregularities or warn each other. Also, having a conversation protocol installed on how to interact with outsiders, was a measure taken by all organisations where attacks by telephone failed. Therefore, it is more difficult for an outsider to get access to the organisation by means of social engineering. This paper ends with a discussion and some recommendations for organisations, e.g. the design of the work environment, to help increase their resilience against social engineering attacks. https://openaccess.cms-conferences.org/publications/book/978-1-958651-29-2/article/978-1-958651-29-2_8 DOI: 10.54941/ahfe1002203
DOCUMENT
While many researchers have investigated soft skills for different roles related to business, engineering, healthcare and others, the soft skills needed by the chief information security officer (CISO) in a leadership position are not studied in-depth. This paper describes a first study aimed at filling this gap. In this multimethod research, both the business leaders perspective as well as an analysis of CISO job ads is studied. The methodology used to capture the business leaders perspective is via a Delphi study and the jobs adds are studied using a quantitative content analysis. With an increasing threat to information security for companies, the CISO role is moving from a technical role to an executive role. This executive function is responsible for information security across all layers of an organisation. To ensure compliance with the security policy among different groups within the company, such as employees, the board, and the IT department, the CISO must be able to adopt different postures. Soft skills are thus required to be able to assume this leadership role in the organisation. We found that when business leaders were asked about the most important soft skills the top three consisted out of 'communication', ‘leadership’ and 'interpersonal' skills while 'courtesy' was last on the list for a CISO leadership role.
MULTIFILE
Een grote groep Nederlanders wordt jaarlijks slachtoffer van phishing. Burgers en bedrijven nemen echter in te beperkte mate zelfbeschermende maatregelen. In dit onderzoek wordt in kaart gebracht welke factoren bijdragen aan de intentie om zelfbeschermende maatregelen te nemen tegen phishing door drie risicogroepen, namelijk jongeren, ouderen en mkb’ers. We passen de Protection Motivation Theory toe, en onderbouwen een uitbreiding van dit model met twee factoren: affectieve respons en subjectieve normen. Data is verzameld middels vragenlijstonderzoek bij een panelbureau onder jongeren (N=1179), ouderen (N=1191) en mkb’ers (N=1020). De sterkste voorspeller voor de intentie tot het nemen van zelfbeschermende maatregelen tegen phishing bleek de affectieve respons (zorgen maken om phishing), gevolgd door een negatief effect van zelfeffectiviteit en positieve effecten van waargenomen ernst (jongeren en mkb’ers) en subjectieve norm (mkb’ers). Implicaties van de bevindingen voor handhavers en interventies worden besproken.
DOCUMENT
Cybercriminaliteit is een veelvoorkomend probleem geworden in Nederland (CBS, 2022). Nederlandse gemeenten hebben cybercrime dan ook breed als beleidsprioriteit opgepakt. Gemeenten geven daarbij aan behoefte te hebben aan handvaten om hun inwoners en ondernemers weerbaarder te maken tegen cybercriminaliteit. In het project “Cyberweerbaarheid: Een gemeentelijk offensief ter preventie van slachtofferschap van cybercrime” werken professionals uit twaalf4 gemeenten en vier5 regionale veiligheidsnetwerken samen met onderzoekers van de Haagse Hogeschool, Hogeschool Saxion en het Nederlands Studiecentrum Criminaliteit en Rechtshandhaving (NSCR) aan wetenschappelijk onderbouwde interventies waaromee ambtenaren openbare orde en veiligheid de cyberweerbaarheid van burgers en bedrijven binnen hun gemeente kunnen vergroten. In dit rapport staat slachtofferschap van cybercriminaliteit onder mkb’ers centraal. Het midden‐ en kleinbedrijf (mkb) wordt relatief vaak slachtoffer van cybercriminaliteit en ondervindt hiervan in hoge mate schade (CBS, 2018; Notté et al., 2019). Met name de toename van slachtofferschap van ransomware binnen het mkb is een zorgelijke ontwikkeling. Het is van groot belang dat mkb’ers maatregelen nemen om een ransomware aanval te voorkomen en de schade zo veel mogelijk te beperken. Beschermende maatregelen worden echter door veel mkb’ers slechts in geringe mate ingezet (Bekkers et al., 2021; CBS, 2021; Notté et al., 2019; Veenstra et al., 2015). De cyberweerbaarheid van mkb’ers (het vermogen van een organisatie om cyberincidenten te weerstaan, daarop te kunnen reageren en van te herstellen, zodat de organisatie operationeel blijft) is daardoor te beperkt. In dit rapport presenteren we de ontwikkeling en evaluatie van een interventie genaamd “MKB Cyber Buddy’s”. Het doel van de interventie is om de weerbaarheid van mkb’ers tegen ransomware te vergroten. De interventie is er op gericht om mkb’ers niet alleen te informeren over cybercriminaliteit, maar ze ook door actieve deelname tot een positieve gedragsverandering te brengen. Onder mkb’ers verstaan we in dit onderzoek ondernemers met minimaal één en maximaal 250 werknemers. De hoofdvraag in dit rapport is: Is de interventie “MKB cyber buddy’s” een effectieve interventie voor Nederlandse gemeenten om de cyberweerbaarheid van mkb’ers in hun gemeente met betrekking tot ransomware te bevorderen? Het doel van dit rapport is tweeledig. Enerzijds beschrijft dit rapport de onderbouwing en ontwikkeling van de interventie “MKB Cyber Buddy’s”. Anderzijds beschrijft dit rapport de evaluatie van de pilot die is uitgevoerd in 2022, betreffende de effectiviteit, sterke kanten, valkuilen en onvoorziene gevolgen van de interventie. Hiermee zullen inzichten geboden worden in hoe de interventie verbeterd kan worden en in de toekomst op grotere schaal kan worden ingezet.
DOCUMENT
While traditional crime rates are decreasing, cybercrime is on the rise. As a result, the criminal justice system is increasingly dealing with criminals committing cyber-dependent crimes. However, to date there are no effective interventions to prevent recidivism in this type of offenders. Dutch authorities have developed an intervention program, called Hack_Right. Hack_Right is an alternative criminal justice program for young first-offenders of cyber-dependent crimes. In order to prevent recidivism, this program places participants in organizations where they are taught about ethical hacking, complete (technical) assignments and reflect on their offense. In this study, we have evaluated the Hack_Right program and the pilot interventions carried out thus far. By examining the program theory (program evaluation) and implementation of the intervention (process evaluation), the study adds to the scarce literature about cybercrime interventions. During the study, two qualitative research methods have been applied: 1) document analysis and 2) interviews with intervention developers, imposers, implementers and participants. In addition to the observation that the scientific basis for linking specific criminogenic factors to cybercriminals is still fragile, the article concludes that the theoretical base and program integrity of Hack_Right need to be further developed in order to adhere to principles of effective interventions.
DOCUMENT
Entrepreneurs are likely to be victims of ransomware. Previous studies have found that entrepreneurs tend to adopt few preventive measures, thereby increasing their chances of victimization. Due to a lack of research, however, not much is known about why entrepreneurs lack self-protective behaviors and how they can be encouraged to change said behaviors. Therefore, the purpose of this study is to explain, by means of an extended model of the Protection Motivation Theory (PMT), the motivation for entrepreneurs using protective measures against ransomware in the future. The data for our study were collected thanks to a questionnaire that was answered by 1,020 Dutch entrepreneurs with up to 250 employees. Our Structural Equation Modelling (SEM) analysis revealed that entrepreneurs are more likely to take preventive measures against ransomware if they perceive the risk of ransomware as severe (perceived severity), if they perceive their company as being vulnerable (perceived vulnerability), if they are concerned about the risks (affective response), and if they think that the people and companies around them expect them to apply preventive measures (subjective norms). However, if entrepreneurs think that they are capable of handling the risk (self-efficacy) and are convinced that their adopted preventive measures are effective (response efficacy), they are less likely to take preventive measures. Furthermore, for entrepreneurs that outsource IT security, the significant effect of perceived vulnerability and subjective norms disappears. The likelihood of entrepreneurs protecting their business against ransomware is thus influenced by a complex interplay of various motivational factors and is partly dependent on the business’ characteristics. Based on these findings, we will discuss security professionals’ prospects for increasing the cyber resilience of entrepreneurs, thus preventing cybercrime victimization.
DOCUMENT
