Catégorie : Uncategorized

By Marc-André Léger, Ph.D. MBA. MScA. C. Adm.

Keywords

Compliance, Compliance management, information security, cybersecurity

Abstract

This article presents the results of a systematic review of recent academic literature on the cybersecurity compliance management. It proposes a working definition of cybersecurity compliance management as a process for the governance, oversight and tracking of how organizations comply with their cybersecurity, information security and data privacy obligations.

Introduction

It could seem obvious to readers that the timely availability of accurate information is critical to organizations. Because of an insatiable need for information, organizations also need appropriate safeguards to ensure that it is available to authorized stakeholders, according to business requirements, organizations policies, and strategic imperatives. Organizations also select best practices and standards that it wants, or needs, to follow. As well, information used in an organizational context is subject to legal, regulatory, and contractual constraints. Since this will incur the allocation of resources, both financial and human, it needs to be managed appropriately.

To do this as effectively as possible, organizations implement an integrated process of Governance, Risk Management and Compliance, referred to as GRC. This article investigates one of the components on GRC, which is compliance. More specifically, it is interested in cybersecurity compliance. Compliance is not more important than governance or risk management, as they are all important parts, required to successfully support organizations. However, the focus this systematic review is part of a larger project that concerns automated compliance management systems, which justifies the choice of the enquiry.

Methodology

The principal goal of this review is to determine the current state of knowledge in cybersecurity compliance management. The strategy proposed for conducting this systematic review use available academic databases and resources in a structured manner to generate reliable information about a topic. It applies a twelve-step process, developed by our research team to accelerate systematic reviews using data analytics. It is proposed that following the systematic process enhances reliability and scientific value of the results. The steps are described in more details online: https://www.researchgate.net/publication/361760661_Accelerating_your_initial_literature_review_a_process_for_students_starting_in_academic_research. All the supporting material for this article can be found on a GitHub repository: https://github.com/ITriskMgr/systematic-review_CybersecurityComplianceManagement

Determine the topic

Scientific research often starts with a subject to be explored. In this case the subject is determined by a willingness to explore the current state of the art in cybersecurity compliance management. This is part of an interest in developing automated information security compliance assessment, monitoring, and reporting of cybersecurity compliance for Canadian Small and Medium Businesses (SMB). Initial research indicated that there is not much literature on compliance issues specifically related to Canada or to SMBs. As well, the compliance literature does not seem to have a large corpus of material specific to cybersecurity compliance. However, many more general aspects of compliance could bring insights that will be useful. Thus, it is determined that the initial search topic is: “Information system compliance management”.

Choosing keywords

Computer security and cybersecurity are also used as synonyms for information security and is added to the initial search term of Information security. As well, to broaden the initial search, both compliance and compliance management will be used. The first element will help to identify the articles in the general topic. The second and third elements will help to narrow down the results to be more relevant. In this case the last query that is used could be appropriate for the intended purpose at this point while adding limits, as described in the next step. However, because the team intents to use analytical tools and perform bibliometric analysis of the results, it is determined that the next step will proceed with the last query:

(“Information security” OR “computer security” OR cybersecurity) AND «compliance management»

Identify limits

Starting from what is done in the previous steps, restrictions to limit the results to scientific articles published in peer-reviewed journals during the last ten years in English is considered. However, to help determine the optimal period, a bibliometric analysis of Google Scholar citations on compliance from 1960 to 2022 was performed using R-Studio. It was observed that compliance has emerged in scientific literature starting in 1994, when the number of yearly publications reached ten per year. There are very few publications recorded in Google Scholar before that date. It has only passed the 100 publications per year in 2002. Based on this information, no additional limits will be added at this time. However, considering the size of the corpus of documents resulting from the search (200), it would seem reasonable to add date limits (2002 to 2022) and select only Journal articles.

It should be expected to have a large amount of overlap between the different sources. This, once imported into Zotero and 44 duplicates removed. At the end of this step, there are 156 articles remaining following the process described.

Library and additional databases

Retrieving the documents is done using databases available on the Polytechnique Montréal and Concordia University library websites. As both universities have different database subscriptions, this allows for additional sources to be identified. However, it may result in many duplicates. The duplicates can be easily resolved later. To cast a wide net and increase the likelihood of including important literature on a subject, the following databases are used, as they are the most used databases used in our field of inquiry, Scopus, Web of Science, and Engineering Village. The results from the library searches are imported into Zotero and duplicates removed. At this point 179 documents remained.

Triage articles and add keywords

The results are then submitted to a first high-level review. This review looks at the title of the articles and the abstract. This is done to ensure the articles are relevant and ready to be used for the next steps. In this case, 50 articles are removed as they did not indicate a link to the research question, did not meet the standard for academic papers or where not in English. For example, a product evaluation, an editorial or an article that is not from a peer-reviewed process is removed. Following this step 129 articles remained. This step is also an opportunity to help identify additional terms and keywords that can become useful later in the systematic review. The additional terms identified are then used for an automated analysis using R-Studio. From this initial list of keywords and expressions, it becomes possible to start to construct an ontology of the domain, which can then be further improved as the project progresses. This ontology will be used to classify articles.

Create, build, and optimize a literature map

From there, a literature mapping tool is used (https://app.litmaps.co/ ) and a bibtext file export of the articles remaining after the triage step are imported. The literature map gives a visual representation of the articles in the corpus and shows the links between them. It also shows the relative importance of articles in the size of the associated marker. The LitMap tool can then suggests new articles, which are potentially relevant based on what is there. In this case, after a few days and several trials with different combinations of dates and keywords, LitMap only suggested articles about compliance and not about compliance management. Therefore, it is decided not to add articles from the map, this eliminating the need to perform two steps in the review methodology that concern adding articles to the LitMap and re-exporting the results to Zotero. Although it did not generate new articles to add to the systematic review, the LitMap tool allows the team to get a visual outlook of the literature. This graphical presentation is helpful to get a better understanding of what is there and helping to identify the evolution of knowledge in this fields, the connections in the literature and significant articles that are more connected to the corpus of knowledge. This will become helpful in the analysis.

Download all the articles

As mentioned, some of the articles are linked directly to Zotero, as they are already included in previous steps. However, for the up-coming steps in the systematic review, it is necessary to have local copies of all the articles available in PDF. Performing a literature review involves reading and analyzing the articles at some point, so having a copy of them is an obvious necessity. Even if an effort is made to automate as much as possible and have a systematic approach that makes it possible to reduce the number of articles, reading the articles is still required. After a thorough search, a few articles still could not be located, as it is a very small number, they are removed, as keeping references to unavailable articles may be problematic for the next steps and for the analysis. However, this may introduce a small bias in the results. At this step, 127 documents remained in the collection.

Once all the articles have been downloaded a more in-depth review is made to assess their relevance. This step could be done by a team of researchers with the assistance of students. It requires that inclusion and exclusion criterions be identified. At this point there should be enough domain knowledge to make this feasible. If the number of articles is not too large, it might be acceptable to omit this step. Another strategy that might be considered is to perform a review by looking at the abstracts only to assess relevance for inclusion or exclusion. Then a review can be performed by reading more comprehensive machine-generated summaries. This would be followed by the lecture of the full articles that make it through the process. An initial automated analysis is performed using R-Studio.

Analyze the documents

The final step in the systematic review is to use the final selection of articles to perform a more in-depth analysis of the corpus of documents. This step is done using two strategies: by reading the articles and with the help automation.  Reading involves, as it would imply, that the articles be read, that key information be highlighted and that notes be taken, using Zotero or other annotation tools. Automation would involve using natural language processing tools. In this case, R-Studio applications and bibliometric analysis are used using Bibliometrix and Quanteda (Benoit et al., 2018). Based on the bibliometric and automated analysis, a final sample of what appears to the research team to be the most relevant sources based on the results of the analysis is presented in a later section of this article.

Automated analysis of the corpus

The first automated analysis is done in R-Studio. It was found that 26 words that appear more 2000 times. In fact, the R Studio code that was used creates an Excel file with all the keywords that appear at least 100 times in the corpus, of which there are 1573 different keywords. Further analysis is performed using a combination of keywords that are relevant to the subject. However, when examining the complete list of keywords, it became obvious that there could be errors due to the different form of the keywords that appear in the corpus. With the keywords systems and used, there would be more accuracy in the intent of the documents to combine variations of a word, thus using stems. Hence, it was decided to use stemmed keywords, rather that the regular for of the words. Here as well, the R Studio code creates an Excel file with all the stemmed keywords that appear at least 100 times in the corpus, of which there are 1289 different keywords.

From this information, further refinement was done to determine the relevance of the documents in the corpus to the research question. This is done to eliminate from the corpus documents that are not sufficiently important, thus optimizing the use of resources. This was done with a combination of keywords that are closely correlated to the theme of compliance management, identified as group K1. The top ten documents, including the top six documents that had a K1 group value of above 1000. This is a simple calculation based on the total number of occurrences of the words in the PDF files. This is subject to many biases, of course. For example, it is impacted by less relevant data, such occurrences in the bibliography. Longer documents would naturally have more potential to have more occurrences. As well, an article is not necessary more relevant if a particular word occurs more often. However, in conjunction with other data, this does contribute to our analysis.

An example of the potential biases of this initial analysis is shown in the highest ranked document (Stroup, 2014). This is not a peer-reviewed journal article but rather it is a Ph.D. dissertation, from a candidate Capella. While it is relevant, it is more about governance than compliance management. The second document (Yang, 2018), is much more relevant, even if it presents a literature review done as part of a Master’s degree and has the added element of being supervised by Siponen Mikko, which is identified in a Scopus and a Web Of Science review as being an influential author of scientific publications on compliance, as the bibliometric analysis has identified.

Another strategy adopted to try to mitigate the biases created by larger documents is to consider the number of pages in the document to calculate a factored value of K1, which is named Fac K1. This is simply calculated by dividing the K1 value by the number of pages in the document. The top 10 results of the 127 documents are presented in table 1.

Doc No	Reference	Nb Pages	K1 Rank	K1	Fac K1 Rank	Fac K1
75	(Mayer & De Smet, 2017)	9	15	601	1	66,78
62	(Joshi, 2008)	9	18	560	2	62,22
35	(Delavari, Elahi, et al., 2019)	6	46	371	3	61,83
116	(von Solms, 2005)	5	61	301	4	60,20
98	(Pla et al., 2020)	6	53	351	5	58,50
10	(AlKalbani et al., 2017)	11	14	618	6	56,18
88	(Nissen & Marekfia, 2013)	6	57	336	7	56,00
11	(Almutairi & Riddle, 2018)	7	43	380	8	54,29
104	(Sabillon et al., 2017)	7	48	364	9	52,00
45	(Fenz et al., 2015)	4	89	206	10	51,50
33	(Dang et al., 2019)	6	67	285	11	47,50

A manual analysis shows that the Fac K1 value does appear to correlate to the relevance of the article. For example, (Mayer & De Smet, 2017) presents a systematic review on the subject of governance, risk management and compliance (GRC) that looks into ISO standards on this topic. Examining a sample of the articles it seems that the higher the Fac K1, the more the document is relevant and that lower ranked Fac K1 values are less relevant. The lower ranked documents are then targeted to be considered for exclusion from the corpus, potentially allowing the team to optimize the use of resources to review the documents and complete the systematic review. In appendix D, documents displayed in red were removed from the corpus for the analysis once the fac K1 test was performed, and a final review of these documents was done to confirm that removal was justified.

Following a review of the results, the decision is made to remove from further steps of the systematic review all articles that have a Factored K1 value of less than one standard deviation below the average. In this case applying the value of 5,34, would result in 15 documents to be removed, leaving 113 documents in the corpus. However, before removing any documents, they were further scrutinized. One document with a score of zero was found to be relevant but is not processed accurately in the previous steps as the PDF file was saved as an image, making it impossible to be assessed automatically. The article was converted using OCR and kept for the next steps. Two documents were also found to be relevant. In the end, 11 documents were removed from the corpus. Following this, 116 documents remained in the corpus. The histogram in figure x, shows the distribution of the documents per publication year. These 116 documents, published from 2004 to 2022 form the corpus for the rest of this article and used for the next step of analysis, as illustrated in figure 3.

N-gram identification

The next automated analysis that is performed is the identification of N-grams in the corpus. The goal is to identify groupings of keywords, in this case of two, three or four words. For this purpose, R-Studio is used. The strategy was to use an automated process to identify bigrams, made of two words that appear in sequence in the corpus, trigrams, made of three words and quad-grams, made of four words. Following this automated process, the most frequent bigrams are identified. Two bigrams were removed as they are less relevant as they more related to the context or the methodology components of the document. The bigrams that were removed are literature review, intern confer, and case studi. However, all the others are directly related to the research question, further supporting that this is useful. When looking at the top twenty (20) trigrams, it was observed that many trigrams that are useful and relevant (12/20). However, there are several (8/20) that are not relevant and were removed, such as: author licens use, and licens use limit. When observing the eleven (11) quad-grams, it can be observed there are few trigrams that are useful and relevant (1/12). But one particularly stands out, inform secur polici complianc, as confirming an intuition that much of the corpus concerns information security policy compliance, a popular topic in the cybersecurity compliance literature. Similarly, nation institut standard technolog, would indicate that National Institute of Science and Technology or NIST, a very popular source of guidance, standards, and frameworks in this area. At this point, there is ample data acquired in a systematic review process to help understand the concept of compliance management. However, it was also decided to proceed with a bibliometric analysis to inform further insights. As this is done using existing analytical tools, it would not add excessive work. This is described in the next section.

Bibliometric analysis

To perform in-depth bibliometric analysis of the corpus of documents using Bibliometrix (https://www.bibliometrix.org/home/ ) the keywords «compliance management» are used to produce information from Web of Science. This resulted in 346 refences exported from Web Of Science (WoS) in Bibtext format that are analyzed using r-studio and an existing library called Bibliometrix, as shown in table 2. The column Results WoS presents this data. The analysis showing the results was supplemented by the data already collected on the corpus of 116 documents, shown as Systematic Review (SR) Corpus in table 2. The data was analyzed using R-Studio and statistical functions in Excel. In some cases, the data was also calculated from the Zotero database or manually counted.  

Description	Results WoS	SR Corpus
Timespan of articles	1979 to 2022	2004 to 2022
Sources (Journals, Books, etc)	299	108
Documents	346	116
Annual Growth Rate %	5.73	5.3
Document Average Age	9.53	5.5
Average citations per doc	9.965	51.60
References	8782	5986

The data presented in table 2 compares the results of the Web of Science query on compliance management, comprising 346 documents published from 1979 to 2022, with the results collected in the corpus of 116 documents used in the systematic review, published from 2004 to 2022. As previously mentioned, the documents collected concern cybersecurity compliance management. As such the two are comparable and this information can help develop further insights, as well as validate the corpus.

Literature review

Following the bibliometric analysis of the corpus, which is presented in the previous sections, this section presents an overview of current knowledge around cybersecurity compliance management. The review is based on the corpus of 116 documents that is identified at the end of the process. Reminding readers that the search query used. From the query, documents were identified and scored to facilitate the process. Most of the documents scored a high Factored K1 value, indicating their high correlation to the keywords that describe the research question. This is important to the team as this literature review a necessary step in empirical research. Observing the literature for compliance and compliance management, not limited to cybersecurity, the number of academic and peer-reviewed sources seems to be relatively small. Particularly, when compared to previous articles in cybersecurity, where the number of articles is much larger. However, by following the systematic review process described, and looking at the metrics, the documents that remain in the corpus appear to be the most relevant.

The literature review starts with the concept of compliance and how it differs in cybersecurity compared to other areas of compliance. It then discusses compliance management and compliance management tools, such as frameworks, standards, and others, that are identified in the literature. To find expressions in the corpus the grep -irl «search text» . command was used in a MacOS Terminal window. This was followed by a manual review of the documents to count the occurrences of the different expressions. As well, R-Studio was used to categorize the articles based on keywords that have been identified in the systematic review. This automated process was chosen to eliminate biases often introduced in this process by reviewers.

Information security

As the research question is investigated a particular aspect of compliance, namely information security compliance, it was decided to also include similar terms in the queries, as described earlier. Of course, a central aspect is information security, or the aspects of security related to information used by organizations in the execution of its mission and by the various business processes required to operate. But since the literature may use different terms, such as cybersecurity to describe information security in a connected world such as organizations involved in e-business or using the Internet as an important component of their strategy. Since it was noticed that cybersecurity may be written in different manners in the articles retrieved. Similar keyword choices were also made in other articles, such as (Anu, 2021).

Organizations need to safeguard the information they need to operate (Fenz et al., 2013). As well, they need to protect their employees access to this information (Chaudhry et al., 2012). The goal of information security as the protection of information systems so they can operate as expected (Yang, 2018). Information security is used to determine the choices organizations need to make and the mitigation measures that they implement to stop the threats against their valued information (Ali et al., 2021). Internal stakeholders, such as employees, are key components of information security management (Chen et al., 2018). Metrics are used to monitor the effectiveness of information security choices (Anu, 2021). In particular, information security governance metrics are an important decision making enabler for organizations to optimize information security programs and strategy (Anu, 2021).

Compliance

Based on the search query used to perform the systematic review, it should be expected that the term compliance appears in all the documents in the corpus. In fact, the term compliance and its variations appear 5627 times in all the 116 documents in the corpus. However, looking at the documents with the highest Factored K1 Scores for a definition, a working definition can be determined. Starting from these sources, and further supported by other documents in the corpus, the literature review, definitions have emerged and presented in this section. A similar strategy is used to develop all the other definitions.

Risk management and compliance are steering tools that organizations integrate in a governance layer (Fenz et al., 2013; Mayer & De Smet, 2017). Referred to as GRC, covering the three complementary disciplines of governance, risk management and compliance. (Mayer & De Smet, 2017) further cite Racz et al., who define GRC as

“an integrated, holistic approach to organization-wide governance, risk and compliance ensuring that an organization acts ethically correct and in accordance with its risk appetite, internal policies and external regulations through the alignment of strategy, processes, technology and people, thereby improving efficiency and effectiveness”[1].

The ISO/IEC 38500:2015 standard, titled “Information Technology — Governance of IT — for the organization” provides normalized guidance and principles for the effective, efficient, and acceptable use of IT within organizations.

At the highest levels of an organization, the board of directors and the executives, Corporate Governance provides strategic and performance guidance as to how objectives are achieved, creating value, while risks are managed appropriately (Al-hashimi et al., 2018; Chaudhry et al., 2012; von Solms, 2005; Yip et al., 2006). This high-level guidance leads, among many other more tactical guidance, which include IT governance and, more specifically, information security governance (Yip et al., 2006). The information security component of corporate governance informs all stakeholders of the organization on how information security is addressed at an executive level and a part of an organization’s overall corporate governance responsibilities (Al-hashimi et al., 2018). It also provide guidance in navigating the complex web of data protection, privacy regulations, and security standards that can help organization to meet its compliance requirements (Fenz et al., 2013; Yip et al., 2006). Information security governance will also guide the organization in the creation of Information Security Policies, a key component of information security(Yang, 2018), which informs internal stakeholders of acceptable use of information systems (Chen et al., 2018). Information security governance is an integral part of good IT and Corporate Governance (von Solms, 2005).

‘Information Security Governance consists of the management commitment and leadership, organizational structures, user awareness and commitment, policies, procedures, processes, technologies and compliance enforcement mechanisms, all working together to ensure that the confidentiality, integrity and availability (CIA) of the company’s electronic assets (data, information, software, hardware, people, etc.) are maintained at all times’. (von Solms, 2005).

Categories of compliance

Multiple categories of compliance have been identified in the context of this study. However, not all of them are relevant in the context of this study. For example, compliances domains related to the environment, public works, or financial services where not considered as relevant, unless it considered specific IT-related or cybersecurity aspects. Other categories that where included are:

• Information security compliance
• Information Security Policy Compliance
• Security policy compliance
• Security Standard Compliance
• Cybersecurity compliance
• Business process compliance
• Legal and regulatory compliance
• Legal compliance
• Regulatory compliance
• Privacy compliance

The expression “cybersecurity compliance” does not appear in any of the documents in the corpus. However, other forms that have a similar meaning in the context of this study are found in the corpus, as expected. The similar forms that have been identified are security compliance, information security compliance, security policy compliance and information security policy compliance. Standard compliance and security standard compliance were also included.

There are other categories of compliance that are mentioned in the corpus. The compliance categories identified include business process compliance, legal and regulatory compliance, legal compliance, regulatory compliance, privacy compliance and environmental compliance. They are included in this study as they could provide valuable insights as to various compliance approaches that can be used for cybersecurity compliance.

Compliance framework

As previously mentioned, a complex web of laws, regulations, standards, policies and contractual obligations contribute to providing compliance requirements (Abdullah et al., 2016). To help organizations fulfil these requirements, various stakeholder groups has created IT governance and compliance frameworks, such as consensus-based standards. The literature in the corpus mentions many of these. COBIT, created by ISACA, ISO 27001 and ISO 27002, created by ISO/EIC subcommittee 27, and NIST cybersecurity framework, created by the National Institute of Science and Technology (NIST) are among the standards most frequently identified with compliance (Al-hashimi et al., 2018; Ali et al., 2021; Delavari et al., 2019; Shamsaei et al., 2011; Sillaber et al., 2019). The ISO/IEC 38500:2015 standard “Information Technology — Governance of IT — for the organization” provides guiding principles on the effective, efficient, and acceptable use of IT within their organizations. It also provides guidance to those advising, informing, or assisting governing bodies. (Mayer & De Smet, 2017)

While many of the articles in the corpus mention specific frameworks that are used for compliance, only two mention the expression “compliance frameworks” directly, (Cabanillas et al., 2022; Shamsaei et al., 2011), while none mention “compliance requirements”.

Compliance management

The expression “compliance management” appears in many articles in the corpus. (Fenz et al., 2015) presented an automated information security risk and compliance assessment tool for hardware, software and data assets based on ISO27002 controls. The strategy (Fenz et al., 2015) developed is based on automatic keyword-based identification of policy documents and assigning them automatically to the most fitting ISO 27002 control. Activities for which compliance must be managed (von Solms, 2005) :

• Previously identified IT risks
• Information Security awareness
• Information Security policies, procedures, and standards
• Regulatory, legal and statutory requirements
• Software Licensing issues and others.

(Abdullah et al., 2016) developed an ontology intended to provide a shared conceptualization of compliance management, the compliance management ontology (CoMOn). This ontology should be integrated in the construction of the cybersecurity compliance ontology that is being created.

Compliance checking

Compliance checking is a process used to enforce compliance to policies and procedures, as well as adequate management of IT risks (von Solms, 2005). In compliance checking, a source of compliance requirements, such as regulations and policies, help to define a set of controls that must be observed by the organization to achieve compliance (Cabanillas et al., 2022). There are many strategies that can be used to perform compliance checking. In the past, manual processes have been used. In regulatory compliance checking, manual compliance checking has been found to be a costly and error-prone process Cunha et al., 2021). There are many other strategies that can be used to improve compliance checking. For example, (Janpitak N. & Sathitwiriyawong C., 2015) proposes an ontology-based automated compliance checking approach for non-log operations. (Cunha et al., 2021) proposes an automated approach for regulatory compliance checking based on the use of empirical fuzzy multi-criterion logic. (Massey et al., 2015) mentions logic-based and requirement modelling approaches to compliance checking that have also been used in software engineering.

Literature analysis

Reminding the reader that this systematic literature review aimed to identify the current state of knowledge on Cybersecurity Compliance Management, this section looks at gaps in the literature on this topic. A few things to consider are mentioned here:

• Compliance, as a research subject, only emerged since the last 20 years.
• Cybersecurity compliance is about 10 years old as a research domain.
• The number of cybersecurity articles that have been identified is lower than wan initially expected.
• Many different types of security-related compliance exist and are studied, cybersecurity is not the most popular area found in published research articles.
• Cybersecurity compliance comprises many specialty areas that include compliance to laws and regulations, contractual obligations, international obligations, privacy, environmental issues related to datacenters, as an example, and many other areas
• Information Security Policy compliance is a popular area of published research.
• Privacy compliance is also another area for which there is large and growing corpus of publications.
• Much of the information found related to cybersecurity compliance metrics is anecdotal or based on commercial solutions for which there is no published peer-reviewed publications that would support its inclusion in this systematic review.
• Information on cybersecurity compliance metrics can be found in product reviews, professional literature, marketing support material or non-academic publications.

Compliance is not an isolated area but as a component of the GRC cybersecurity process triad. Governance gives direction and context, risk management provides information about risk appetite, defines levels of acceptability, and select metrics, while compliance is used to monitor implementation and, without surprise, ensure compliance to legal and contractual obligations, tracks respects of governance objectives and manage risks.

While compliance is predominantly a business concern, it is intrinsically linked to technical aspects of cybersecurity. Because of the complexity of how it is connected to different problem domains, such as legal and regulatory issues, contractual issues, human behavior issues, as well as the technical aspects, a combination of business and technical skills is likely desirable. This, and other reasons, contribute to increasing the subjectivity of compliance evaluation. Also, adding to the problem that most monitoring involves manual review, it is error prone, as well begging subjective, compounding the problem. Mechanisms and tools, such as ontologies proposed by (Abdullah et al., 2016) or automation, perhaps using analytics or machine learning, can help limit the effects. There are many research opportunities in cybersecurity compliance and many researchers interested in this area but there is little peer-reviewed output showing this. This is something that need further investigation to find solutions to resolve this issue.

Based on what identified in this systematic review, a definition of compliance management is proposed:

Compliance Management is concerned with the governance, oversight and tracking of how organizations comply with their obligations.

As there are many categories and levels of obligations, domains of compliance management are needed to address them. As the focus of this systematic review is cybersecurity compliance, the definition can be further developed to address this situation. Hence, a definition of cybersecurity compliance management is proposed:

Cybersecurity Compliance Management provides processes for the governance, oversight and tracking of how organizations comply with their cybersecurity, information security and data privacy obligations.

While this working definition can be further improved, it provides a reasonable starting point that is congruent with the findings of the systematic review that was performed and described in this article. It is sufficiently vague to allow for the various categories of compliance that need to be integrated into the cybersecurity domain. It also allows for the use of this definition in the design of an automated compliance management and assessment solution that can be done.

Conclusion

This article described a systematic review of cybersecurity compliance management. It was performed with a specific goal in mind, to support the design of an information system to assist organization achieve and maintain compliance. While one of the findings is that the corpus of scientific publications is smaller than it should probably be, considering how this is such an important topic and how important it is to organizations today. It was also found that cybersecurity compliance is a multi-dimensional problem, including several problem domains, such as legal, organizational, human, and technical, and requiring but business and technical solutions.

Bibliography

Abdullah, N. S., Indulska, M., & Sadiq, S. (2016). Compliance management ontology—A shared conceptualization for research and practice in compliance management. Information Systems Frontiers : A Journal of Research and Innovation, 18(5), 995‑1020. https://doi.org/10.1007/s10796-016-9631-4

Agbaegbu, J., Arogundade, O. T., Misra, S., & Damaševičius, R. (2021). Ontologies in Cloud Computing—Review and Future Directions. Future Internet, 13(12), 302. https://doi.org/10.3390/fi13120302

Akhunzada, A., Sookhak, M., Anuar, N. B., Gani, A., Ahmed, E., Shiraz, M., Furnell, S., Hayat, A., & Khan, M. K. (2015). Man-At-The-End attacks : Analysis, taxonomy, human aspects, motivation and future directions. Journal of Network and Computer Applications, 48, 44‑57. https://doi.org/10.1016/j.jnca.2014.10.009

Al-hashimi, M., Othman, M., Sulaiman, H., & Zaidan, A. A. (2018). Information Security Governance Frameworks in Cloud Computing an Overview. Journal of Advanced Computer Science and Technology Research, 8(2), 67‑81.

Ali, R. F., Dominic, P. D. D., Ali, S. E. A., Rehman, M., & Sohail, A. (2021). Information security behavior and information security policy compliance : A systematic literature review for identifying the transformation process from noncompliance to compliance. Applied Sciences, 11(8), 3383. https://doi.org/10.3390/app11083383

AlKalbani, A., Deng, H., Kam, B., & Zhang, X. (2017). Information Security Compliance in Organizations : An Institutional Perspective. Data and Information Management, 1(2), 104‑114. https://doi.org/10.1515/dim-2017-0006

Al-Rashdi, Z., Dick, M., & Storey, I. (2017). Literature-based analysis of the influences of the new forces on ISMS : A conceptual framework.

Alsharif, I., & Khelifi, A. (2019). Exploring the Opportunities and Challenges of Open Source Software and Its Economic Impact on the Cybersecurity Market. Smart Technologies and Innovation for a Sustainable Future, 115‑127.

Anu, V. (2021). Information security governance metrics : A survey and taxonomy. Information Security Journal: A Global Perspective, 1‑13.

Bélanger, F., & Crossler, R. E. (2011). Privacy in the digital age : A review of information privacy research in information systems. MIS quarterly, 1017‑1041. https://doi.org/10.2307/41409971

Benoit, K., Nulty, P., Obeng, A., Müller, S., & Matsuo, A. (2018). quanteda : An R package for the quantitative analysis of textual data. Journal of Open Source Software, 774.

Bibliometrix—Home. (s. d.). Consulté 15 août 2022, à l’adresse https://www.bibliometrix.org/home/

Bicaku, A., Zsilak, M., Theiler, P., Tauber, M., & Delsing, J. (2022). Security Standard Compliance Verification in System of Systems. IEEE Systems Journal, 16(2). https://doi.org/10.1109/JSYST.2021.3064196

Cabanillas, C., Resinas, M., & Ruiz-Cortes, A. (2022). A Mashup-Based Framework for Business Process Compliance Checking. IEEE Transactions on Services Computing, 15(3). https://doi.org/10.1109/TSC.2020.3001292

Chaudhry, P. E., Chaudhry, S. S., Reese, R., & Jones, D. S. (2012). Enterprise information systems security : A conceptual framework. Re-conceptualizing Enterprise Information Systems, 118‑128.

Chen, X., Chen, L., & Wu, D. (2018). Factors That Influence Employees’ Security Policy Compliance : An Awareness-Motivation-Capability Perspective. Journal of Computer Information Systems, 58(4), 312‑324. https://doi.org/10.1080/08874417.2016.1258679

Culot, G., Nassimbeni, G., Podrecca, M., & Sartor, M. (2021). The ISO/IEC 27001 information security management standard : Literature review and theory-based research agenda. The TQM Journal.

Cunha, V. H. C., Caiado, R. G. G., Corseuil, E. T., Neves, H. F., & Bacoccoli, L. (2021). Automated compliance checking in the context of Industry 4.0 : From a systematic review to an empirical fuzzy multi-criteria approach. Soft Computing, 25(8), 6055‑6074.

Da Veiga, A., & Eloff, J. H. P. (2007). An Information Security Governance Framework. Information Systems Management, 24(4), 361‑372. https://doi.org/10.1080/10580530701586136

Dang, L. M., Piran, M. J., Han, D., Min, K., & Moon, H. (2019). A survey on internet of things and cloud computing for healthcare. Electronics, 8(7), 768.

Delavari, V., Shaban, E., Janssen, M., & Hassanzadeh, A. (2019). Thematic mapping of cloud computing based on a systematic review : A tertiary study. Journal of Enterprise Information Management.

Esayas, S., & Mahler, T. (2015). Modelling compliance risk : A structured approach. Artificial Intelligence and Law, 23(3), 271‑300. https://doi.org/10.1007/s10506-015-9174-x

Fenz, S., Heurix, J., & Neubauer, T. (2015). How to increase the inventory efficiency in information security risk and compliance management. 2015-May.

Fenz, S., Neubauer, T., Accorsi, R., & Koslowski, T. (2013). FORISK: Formalizing information security risk and compliance management. 4 pp.-. https://doi.org/10.1109/DSNW.2013.6615533

Foorthuis, R., & Bos, R. (2011). A Framework for Organizational Compliance Management Tactics. In C. Salinesi & O. Pastor (Éds.), Advanced Information Systems Engineering Workshops (Vol. 83, p. 259-+). Springer-Verlag Berlin. http://www.webofscience.com/wos/woscc/summary/ef98347e-e620-4445-90b7-1dcb9f988d95-417d1e10/relevance/1

Gupta, B. B., & Badve, O. P. (2017). Taxonomy of DoS and DDoS attacks and desirable defense mechanism in a cloud computing environment. Neural Computing and Applications, 28(12), 3655‑3682.

Hassanzadeh, A., Rasekh, A., Galelli, S., Aghashahi, M., Taormina, R., Ostfeld, A., & Banks, K. (2020). A review of cybersecurity incidents in the water sector. arXiv preprint arXiv:2001.11144.

Jacobs, P., Arnab, A., & Irwin, B. (2013). Classification of security operation centers. 7 pp.-. http://dx.doi.org/10.1109/ISSA.2013.6641054

Janpitak N. & Sathitwiriyawong C. (2015). Automated Compliance Checking Methodology for Non-Log Operations. Information Security Journal, 24(4‑6), 98‑108. https://doi.org/10.1080/19393555.2015.1067340

Joshi, S. (2008). HIPAA, HIPAA, Hooray? : Current Challenges and Initiatives in Health Informatics in the United States. Biomedical informatics insights, 1. https://doi.org/10.4137/BII.S2007

Marbouh, D., Abbasi, T., Maasmi, F., Omar, I. A., Debe, M. S., Salah, K., Jayaraman, R., & Ellahham, S. (2020). Blockchain for COVID-19 : Review, opportunities, and a trusted tracking system. Arabian journal for science and engineering, 45(12), 9895‑9911.

Martínez-González, M. M., Alvite-Díez, M. L., Casanovas, P., Casellas, N., Sanz, D., & Aparicio, A. (2021). OntoROPA Deliverable 1. State of the Art and Ambition.

Massey, A. K., Otto, P. N., & Antn, A. I. (2015). Evaluating Legal Implementation Readiness Decision-Making. IEEE Transactions on Software Engineering, 41(6). https://doi.org/10.1109/TSE.2014.2383374

Mayer, N., & De Smet, D. (2017). Systematic Literature Review and ISO Standards analysis to Integrate IT Governance and Security Risk Management. International Journal for Infonomics (IJI), 10(1), 1255‑1263.

Nissen, V., & Marekfia, W. (2013). Towards a research agenda for strategic governance, risk and compliance (GRC) management. 2013 IEEE 15th Conference on Business Informatics, 1‑6.

Noor, T. H., Sheng, Q. Z., Maamar, Z., & Zeadally, S. (2016). Managing Trust in the Cloud : State of the Art and Research Challenges. Computer, 49(2). https://doi.org/10.1109/MC.2016.57

Pereira, R., & da Silva, M. M. (2013). IT Compliance Management Process Modeling Based on Best Practices Reference Models and Qualitative Data. 2013 17th IEEE International Enterprise Distributed Object Computing Conference Workshops, 178‑187.

Plá, L. F., Shashidhar, N., & Varol, C. (2020). On-premises versus SECaaS security models. 2020 8th International Symposium on Digital Forensics and Security (ISDFS), 1‑6.

Reshmi, T. R. (2021). Information security breaches due to ransomware attacks-a systematic literature review. International Journal of Information Management Data Insights, 1(2), 100013. https://doi.org/10.1016/j.jjimei.2021.100013

Sabillon, R., Serra-Ruiz, J., Cavaller, V., & Cano, J. (2017). A comprehensive cybersecurity audit model to improve cybersecurity assurance : The cybersecurity audit model (CSAM). 2017 International Conference on Information Systems and Computer Science (INCISCOS), 253‑259.

Sackmann, S., Kuehnel, S., & Seyffarth, T. (2018). Using business process compliance approaches for compliance management with regard to digitization : Evidence from a systematic literature review. International Conference on Business Process Management, 409‑425.

Salek, M. S., Khan, S. M., Rahman, M., Deng, H.-W., Islam, M., Khan, Z., Chowdhury, M., & Shue, M. (2022). A Review on Cybersecurity of Cloud Computing for Supporting Connected Vehicle Applications. IEEE Internet of Things Journal, 9(11), 8250‑8268. https://doi.org/10.1109/JIOT.2022.3152477

Shamsaei, A., Amyot, D., & Pourshahid, A. (2011). A systematic review of compliance measurement based on goals and indicators. International Conference on Advanced Information Systems Engineering, 228‑237.

Sillaber, C., Mussmann, A., & Breu, R. (2019). Experience Data and Information Quality Challenges in Governance, Risk, and Compliance Management. Journal of Data and Information Quality (JDIQ), 11(2), 1‑14. https://doi.org/10.1145/3297721

Stroup, J. W. (2014). The current mind-set of federal information security decision-makers on the value of governance : An informative study.

von Solms, S. H. (Basie). (2005). Information Security Governance—Compliance management vs operational management. Computers & Security, 24(6), 443‑447. https://doi.org/10.1016/j.cose.2005.07.003

Wollersheim, J., & Krcmar, H. (2014). Quality analysis approaches for cloud services-towards a framework along the customer’s activity cycle. Trusted Cloud Computing, 109‑124.

Yang, Y. (2018). Literature review of information security practice survey reports.

Yimam, D., & Fernandez, E. B. (2016). A survey of compliance issues in cloud computing. Journal of Internet Services and Applications, 7(1), 1‑12. https://doi.org/10.1186/s13174-016-0046-8

Yip, F., Ray, P., & Paramesh, N. (2006). Enforcing business rules and information security policies through compliance audits. 2006, 81‑90. Scopus. https://www.scopus.com/inward/record.uri?eid=2-s2.0-33847152561&partnerID=40&md5=0c52f181e1f0c2715a294162858de3b5

Zandesh, Z., Ghazisaeedi, M., Devarakonda, M. V., & Haghighi, M. S. (2019). Legal framework for health cloud : A systematic review. International journal of medical informatics, 132, 103953.

---

[1] N. Racz, E. Weippl, A. Seufert, A Frame of Reference for Research of Integrated Governance, Risk and Compliance (GRC), in: B.D. Decker, I. Schaumüller-Bichl (Eds.), Communications and Multimedia Security, Springer Berlin Heidelberg, 2010: pp. 106–117. cited in (Mayer & De Smet, 2017)

In the intricate web of modern society where the sails of technology, health, finance, and business are ever billowed by the winds of change, the notion of ‘risk’ stands as a crucial beacon in navigating the unpredictable. Originating from the perilous ventures at sea signified by the Middle-Ages Italian term ‘risco’, risk has journeyed through centuries to emerge as a central theme in diverse domains of human activity. As a university professor deeply engaged in the study of information technology and cybersecurity, I find that the contemporary understanding of risk requires a synthesis of its historical essence through a multidisciplinary lens. Herein, I propose an updated, synthesized definition of risk, aimed at encompassing the breadth and depth of its impact across various fields of study and practice. I started by feeding all the risk definitions I had found in my many literature searches in the last few years into ChatGPT, and this is a snapshot of what we came up with.

Risk Reenvisioned: A Tapestry of Probabilities and Possibilities

Risk, at its core, encapsulates the potential for deviation from anticipated outcomes, driven by uncertainty and complexity. It is a tapestry woven from event probabilities and their diverse consequences—ranging from the catastrophic to the opportunistic. This proposition extends beyond theoretical discourse into a pragmatic framework that recognizes risk as a dynamic entity, simultaneously informed by subjective judgment and empirical evidence. It is a paradigm that transcends the traditional association of risk solely with negative outcomes. It acknowledges the silver lining of opportunity uncertainty can present.

The Need for a Comprehensive Risk Framework

The impetus behind this comprehensive risk framework is multifold. Primarily, it acknowledges risk’s interdisciplinary manifestations across various sectors. In finance, risk encapsulates the gamut of market volatility and investment uncertainties; in medicine, it concerns the probabilities of health-related adversities; in information technology, it pertains to the spectrum of security threats and data integrity challenges. The proposed definition champions universal applicability, promoting a cohesive narrative and more strategic risk management.

Furthermore, this framework recognizes the dichotomy of risk: it is the chasm of possible loss and the crucible of potential innovation. It proposes a balanced approach to risk management, one that judiciously seeks out potential advantages as it diligently mitigates potential threats.

Scholarly Rationale for the Integrated Definition of Risk

The scholarly impetus for this integrated definition is rooted in the labyrinthine nature of contemporary issues. These issues are characterized by intertwined global systems, rapid innovation, and the complex interplay between human factors and systemic vulnerabilities. This complexity calls for a definition that is both robust and adaptive, capable of underpinning sophisticated risk management strategies responsive to an ever-evolving global milieu.

Moreover, this definition is a testament to the value of interdisciplinarity in academic inquiry and professional practice. By merging various conceptual models of risk—from the quantifiable ‘risk capital’ in financial markets to the qualitative ‘informational risks’ in cybersecurity—it fosters a transdisciplinary dialogue, facilitating a more comprehensive approach to addressing risk.

Consider cybersecurity, where risk is not confined to breaches but also encompasses organizational responses to such incursions. This includes the adoption of cutting-edge security practices and the development of robust, resilient infrastructures. In healthcare, risk management extends from disease prevention to the creation of healthcare systems that are reactive but also proactive in their approach to patient care and disease management.

Conclusion: Uniting Under the Banner of a Unified Risk Understanding

Embracing this refined definition of risk marks a step toward a unified understanding of the concept. It invites us to reflect on both the probability and potential consequences of unforeseen events. It also invites us to reflect on risk’s prospects for progress. As we steer through the complexities of the 21st century, an intricate understanding of risk is not merely an academic exercise but a strategic imperative for informed decision-making, foresight in planning, and the development of systems that are equipped to withstand but also capitalize on the uncertainties of our times.

This definition should act as a cornerstone in academia, prompting scholars to expand their viewpoints and consider risk interconnectedness across different disciplines. By encouraging a forward-looking and inclusive perspective, we can cultivate anticipatory, adaptive, and holistic strategies, ensuring we are prepared to meet the unknown with confidence and resourcefulness. In a world where change is the only constant, a multifaceted understanding of risk is not just beneficial—it is essential for the growth and resilience of societies and the individuals within them.

In the intricate dance of market economics, supply and demand traditionally lead the way, dictating prices and guiding consumer behavior. Nevertheless, in the grand ballroom of commerce, there exists a paradoxical player: Veblen goods. Named after the economist Thorstein Veblen, who first illuminated their peculiar nature, Veblen goods flip the script on conventional economic wisdom. They challenge producers and consumers alike to rethink value and advantage.

Defying Demand: The Veblen Good Explained

Veblen goods have a contrarian response to price changes. Unlike typical products, where demand decreases as prices rise, Veblen goods see an uptick in demand precisely when their prices soar. This anomaly is rooted in the social symbolism these goods carry; they are not merely purchases but proclamations of status. Owning a Veblen good is like wearing a medal of economic prowess, signaling wealth and social distinction. As such, their value is not solely in their utility but in their scarcity and prestige. For instance, Birkin bags, handmade leather bags made by Hermès in France, have become a symbol of wealth and status. Their prices reach up to hundreds of thousands of dollars for the rarest models made in exotic leathers. Rolex watches are also perceived as symbols of luxury and social status. Some models, like the Submariner or Daytona, sell for thousands of dollars over retail prices on the secondary market, as individuals strive to bypass retail waitlists.

The Economics of Exclusivity: How Veblen Goods Break the Mold

The traditional supply and demand curve is a testament to the rationality of the market. This is where increased supply typically lowers prices, and heightened demand usually leads to price hikes. Veblen goods, however, dance to another tune. Their demand curve slopes upwards, reflecting increased demand as prices rise. This phenomenon is a stark departure from the norm, presenting an unusual challenge to businesses: how to price a product not only for profit but for prestige.

Competitive Advantage in a Veblen Economy

In the pursuit of competitive advantage, companies dealing in Veblen goods must navigate a landscape where the usual rules do not apply. The perceived rarity and perceived value of these goods become the cornerstone of strategy. Note the importance of perception as the key factor, making this highly subjective. For businesses, this means crafting an image that resonates with exclusivity and desirability. This is often accomplished through limited editions, bespoke services, or by harnessing luxury branding allure.

The IT Paradox: Veblen Goods in the Digital Age

Information technology, with its rapid innovation cycles and democratizing force, seems an unlikely sector for Veblen goods. Yet, even here, the Veblen effect holds. High-end technology products can attain Veblen status when marketed as elite, cutting-edge, or revolutionary. The latest smartphone, for instance, may boast features marginally different from its predecessor. However, its positioning as a must-have gadget for the tech-savvy elite can drive demand upward with each price increase.

E-commerce and the Veblen Effect

E-commerce platforms have become the modern-day marketplaces for Veblen goods, amplifying their reach and reinforcing their desireability through strategic digital marketing. The online space allows for the creation of an aura around Veblen goods, often through storytelling, influencer endorsements, and the cultivation of digital scarcity. The result is a virtual environment where consumers are willing to pay premiums not just for the product but for the shopping experience and the status it bestows.

Social Media: The Amplifier of Aspiration

Social media platforms serve as echo chambers for Veblen goods. They are stages where the drama of aspiration and prestige plays out, with each share, like, and comment adding to the narrative of exclusivity. In this realm, Veblen goods gain their luster not from price tags but from social validation and visibility. Brands leverage this dynamic, using social media to craft a coveted image that turns their offerings into symbols of social capital.

Sustaining Advantage in a Veblen World

For businesses, the challenge lies in sustaining the Veblen effect. It is a delicate balance between maintaining high prices and perceived exclusivity while ensuring that the allure does not fade. This requires a deep understanding of consumer psychology, a commitment to innovation, and a marketing strategy that continually reinforces the narrative of prestige.

Conclusion: The Veblen Good as a Competitive Chess Piece

Veblen goods are a testament to the complexity and psychological underpinnings of market economics. They serve as a reminder that value is not always intrinsic but reflects societal perceptions and desires. For companies, IT infrastructure, e-commerce strategies, and social media presence offer them an opportunity to craft a competitive edge based on prestige and exclusivity. However, this edge is only as sharp as the strategy behind it, demanding a nuanced approach to pricing, marketing, and brand storytelling.

In the end, Veblen goods challenge us to reconsider value in a market-driven world. They are not mere commodities but chess pieces in the strategic game of competitive advantage. This is where perception is king, and the price is often a measure of prestige rather than cost. As we navigate the evolving landscape of IT, e-commerce, and social media, understanding the Veblen effect is crucial for those looking to thrive in the economy of aspiration.

Introduction

In the ever-evolving landscape of cybersecurity, risk analysis has become increasingly complex, requiring advanced computational techniques to address multifaceted challenges. One such advancement is the use of deep learning platforms to analyze cybersecurity risk scenarios. Deep learning, a subset of machine learning, has shown immense promise in various domains, including natural language processing, computer vision, and indeed, cybersecurity. Deep learning can be used to analyze large amounts of data quickly and accurately, enabling organizations to identify patterns and trends in their cybersecurity risk profiles. It can also help organizations identify potential threats and vulnerabilities, and alert them to the need to take preventive or corrective action. This blog post aims to offer an in-depth exploration of the most suitable programming languages and software frameworks that can be leveraged to build a deep learning platform tailored to cybersecurity risk analysis.

Criteria for selection

When choosing a programming language and software framework for such a specialized task, one must consider several factors:

1. Scalability: The ability to handle large and complex datasets effectively.
2. Performance: Speed and computational efficiency.
3. Community Support: Prebuilt libraries and a strong community.
4. Interoperability: Seamless integration with existing systems and databases.
5. Ease of Use: A manageable learning curve and a user-friendly interface.

Python programming language

Python is a high-level, interpreted, and object-oriented programming language. Its syntax is designed to be simple and easy to understand, making it an ideal language for beginners. Python also has a wide range of libraries and frameworks that make it easy to become productive quickly, and its user-friendly interface makes it easy to learn. Python emerges as the frontrunner for building a Deep Learning platform to analyze cybersecurity risk scenarios for several reasons:

Rich ecosystem

Python boasts a rich ecosystem of libraries specifically designed for machine learning and deep learning, such as TensorFlow, PyTorch, and Keras. These libraries provide pre-built modules and functions, significantly expediting development.

Versatility

Python’s versatility makes it suitable for both data preprocessing and model development, providing a unified platform for the entire machine learning pipeline.

Community support

Python has widespread community support, ensuring that developers can readily find solutions to common problems, plug into community-driven modules, or even contribute to the ecosystem.

Interoperability

Python’s extensive range of APIs allows for easy integration with existing cybersecurity platforms and databases, a crucial factor for any enterprise-level application.

Software Framework: TensorFlow

Among the plethora of available deep learning frameworks, TensorFlow stands out as particularly well-suited to cybersecurity applications for several reasons:

Scalability

TensorFlow can easily scale from a single machine to a cluster of servers, meeting large-scale cybersecurity datasets.

High performance

TensorFlow offers accelerated computation through GPU support, crucial for training large and complex deep learning models efficiently.

Flexibility

TensorFlow provides both high-level APIs for quick prototyping and low-level APIs for fine-tuned customization, making it adaptable to a variety of cybersecurity tasks.

TensorBoard

TensorFlow comes with TensorBoard, a visualization toolkit that aids in understanding, debugging, and optimizing deep learning models. This is invaluable for complex tasks such as cybersecurity risk analysis.

Conclusion

Python and TensorFlow collectively offer a robust, scalable, and efficient environment for building a deep learning platform focused on analyzing cybersecurity risk scenarios. Python provides a versatile and rich programming environment replete with libraries and community support. TensorFlow complements this by offering a high-performance, flexible, and scalable deep learning framework. Together, they form an optimal toolset for tackling cybersecurity risk analysis’s intricacies and complexities through deep learning methods.

Given the critical nature of cybersecurity and the increasing sophistication of cyber threats, adopting the right tools for deep learning-based risk analysis is not merely an academic exercise but a strategic imperative. By leveraging Python and TensorFlow, organizations can better equip themselves to navigate the complex and ever-changing cybersecurity risks landscape.

Introduction

In a world increasingly driven by digital interactions, cybersecurity cannot be underestimated. Cybersecurity frameworks serve as the cornerstone for securing modern organizations’ complex infrastructure. These frameworks encompass a set of guidelines, best practices, and tools designed to provide a structured and strategic approach to cybersecurity management. This blog post aims to elucidate the concept of a cybersecurity framework, its constituent elements, types, and its significance in contemporary information technology environments. Cybersecurity frameworks are an essential element of any organization’s security posture and should be regularly reviewed and updated to ensure their efficacy. Furthermore, organizations should ensure that their employees have the necessary knowledge and skills to effectively implement and adhere to the guidelines and best practices outlined in a cybersecurity framework.

Defining cybersecurity frameworks

A cybersecurity framework is an organized set of guidelines, policies, and procedures aimed at providing a unified strategy for safeguarding an organization’s digital assets and information systems. It serves as a reference model that enables organizations to identify, protect, detect, respond to, and recover from cybersecurity incidents in a systematic and effective manner. The framework typically encapsulates both technical and non-technical components, offering a holistic approach to cybersecurity that is adaptable to an organization’s specific requirements. The framework also helps organizations to develop and maintain a security culture by raising awareness and providing guidance on how to protect their systems and data. Additionally, it provides guidelines on how to recover from a cyber incident and minimize its effects. The framework is like a roadmap for an organization to follow, ensuring that they are taking the necessary steps to protect their systems and data, as well as having a plan in place in the event of a breach.

Historical context

The emergence of cybersecurity frameworks can be traced back to the late 20th and early 21st centuries when digitization of services and operations became commonplace. Organizations soon realized that ad-hoc security measures were insufficient to counter the growing threat landscape. This led to the formulation of structured frameworks, initially by governmental agencies and later by private firms to address the burgeoning need for standardized cybersecurity protocols. Cybersecurity frameworks are typically composed of various elements, such as policy, procedures, and standards. They are designed to help organizations assess their security posture and prioritize their security investments. Cybersecurity frameworks are also constantly evolving to keep up with the ever-changing threat landscape. For example, the National Institute of Standards and Technology (NIST) regularly updates its Cybersecurity Framework to provide guidance on how organizations should protect their networks and systems.

Constituent elements of a cybersecurity framework

Cybersecurity frameworks usually consist of several core components:

1. Policies and Guidelines: These are high-level documents that define the organization’s stance and objectives regarding cybersecurity.
2. Standards and Procedures: These elaborate on the policies by specifying the technical and operational details for achieving the stated objectives.
3. Tools and Technologies: These are the actual hardware and software solutions employed to enforce the standards and procedures.
4. Monitoring and Auditing: This involves continuous observation and periodic evaluation of the system to ensure compliance with the framework.
5. Incident Response Plan: This outlines the steps to be taken when a security breach or incident occurs.
6. Training and Awareness: This element focuses on educating staff about their roles and responsibilities in maintaining cybersecurity.

Types of cybersecurity frameworks

1. National Institute of Standards and Technology (NIST) Framework: Developed by the U.S. government, it is widely used globally and provides guidelines for critical infrastructure sectors.
2. ISO/IEC 27001: An international standard that provides a systematic approach to managing sensitive company information and ensuring its confidentiality, integrity, and availability.
3. Center for Internet Security (CIS) Controls: Focusing on actionable controls for improving cybersecurity posture, it is popular among small and medium-sized enterprises.
4. Payment Card Industry Data Security Standard (PCI DSS): Specifically designed for organizations that handle credit card transactions, this framework focuses on securing financial data.

Significance in contemporary settings

In the modern world, where cyber threats are ever-evolving, cybersecurity frameworks play a pivotal role in safeguarding an organization’s assets and reputation. These frameworks enable organizations to achieve several key objectives:

• Standardization: They provide a standardized approach to cybersecurity, making it easier to manage and measure security efforts.
• Risk Management: They offer a structured way to identify, assess, and manage cybersecurity risks, reducing the likelihood and impact of security incidents.
• Compliance: Adherence to a recognized cybersecurity framework often fulfills legal and regulatory requirements, shielding organizations from potential legal repercussions.
• Operational Efficiency: By providing a structured approach to cybersecurity, frameworks enable more efficient resource allocation and better decision-making.

Conclusion

Cybersecurity frameworks are not merely a set of rules or tools; they are an integral aspect of organizational information security strategy. They offer a balanced approach to cybersecurity by focusing on technology, processes, and people. As the cyber landscape evolves, so too will cybersecurity frameworks, adapting to new types of threats and vulnerabilities. Therefore, understanding and implementing a cybersecurity framework is not just a necessity but a strategic imperative for organizations aiming for resilience and longevity in the digital age.

By comprehensively understanding the multifaceted nature and utility of cybersecurity frameworks, organizations can better prepare for, respond to, and mitigate the risks associated with cyber threats. Therefore, the adoption and implementation of a robust cybersecurity framework should be considered an essential component of any serious effort to secure an organization’s information systems and digital assets.

Today I asked ChatGPT to use the new Dall-E functionality to create an artistic rendition of generative AI that I can use to illustrate an article. Here is what it answered.

Generative AI is an exciting frontier that marries the complex intricacies of artificial intelligence with the boundless realm of creativity. The images presented here aim to encapsulate the essence of this phenomenon.

The first image depicts a classical setting with wooden tables and chairs, which is reminiscent of traditional scholarly environments. Atop one table, an antique brass orrery symbolizing the solar system is placed. Above this classical representation of the universe, a modern, holographic projection of a neural network illuminates the space. This image serves as a metaphor for the juxtaposition of the past and the future, highlighting how the emergence of generative AI is seamlessly intertwining with our rich history of knowledge and discovery.

Photo of a room filled with classic wooden tables and elegant chairs. On one of the tables sits an antique brass orrery, representing the solar system. Above the orrery, a holographic projection showcases a neural network with intricate nodes and connections, glowing in blue and green. This juxtaposition symbolizes the blend of past and future, emphasizing the emergence of generative AI amidst traditional settings.

The second image, rendered in the style of 19th-century Romanticism, paints a vast landscape illuminated by the glow of a golden sunrise. Within this serene setting, silicon chips and circuit boards, emblematic of our digital age, stand tall, reminiscent of ancient monoliths. Ethereal strings of binary code traverse the landscape like meandering rivers, and ghostly digital avatars wander about, signifying the omnipresent influence and power of generative AI in our contemporary world.

Oil painting in the style of 19th-century Romanticism, capturing a vast, dramatic landscape. At the horizon, a golden sunrise casts its light upon a serene meadow. Within the meadow, towering silicon chips and circuit boards rise like ancient monoliths. Ethereal strings of binary code flow like rivers, while ghostly digital avatars wander, symbolizing the omnipresence and power of generative AI in our world.

Both of these artistic representations offer a visual narrative that captures the transformative power of generative AI, bridging the gap between the historical and the cutting-edge, the tangible and the digital, and the known and the yet-to-be-discovered. They emphasize the profound impact of AI on our understanding of creativity, knowledge, and the world at large. I hope one of these images resonates with the theme of your article and can serve as a compelling visual accompaniment.

If you have any further specifications or require adjustments, please let me know. I am here to assist you in your academic endeavors.

Introduction

Cybersecurity continues to evolve at a rapid pace, and fraud continues to be a persistent challenge that organizations and individuals strive to overcome. As sophisticated schemes of fraud become more sophisticated, traditional methods of fraud detection and prevention are becoming increasingly ineffective, despite the fact that they are effective to some extent. In response to this, we have explored more advanced technologies, among them Artificial Intelligence (AI), which is one of the more recent ones. Despite the fact that the role of artificial intelligence in cybersecurity is already well established, the specific utility of generative AI models to prevent, identify, and investigate fraud is a subject that deserves greater attention. In this blog post, we will discuss how generative artificial intelligence can be a game-changer when it comes to these key areas of development. Generative AI models can be used to detect fraudulent activity in real-time. They can also be used to uncover potential fraud before it happens, by analyzing large amounts of data to detect patterns and anomalies. Generative AI models can also be applied to investigate fraud, by providing detailed insights into suspicious activity.

What is generative AI?

Before delving into its applications in fraud management, it is essential to understand what generative AI entails. Generative AI refers to a subset of machine learning models that generate new data that resemble a given dataset. Unlike discriminative models, which classify or differentiate between existing data points, these models can create new instances that share statistical characteristics with the training data. This capability opens up a plethora of applications, ranging from natural language processing to image generation, and, as we will see, fraud management. Generative AI models can also be used to detect fraud by generating new data that is similar to a fraudulent dataset. This can help to detect fraud patterns that are not visible in existing data. Generative AI models can also be used to detect anomalies in data, such as outliers or outliers.

Fraud prevention through anomaly detection

One of the most immediate applications of generative AI in fraud prevention is anomaly detection. Traditional fraud prevention systems often rely on rule-based algorithms that flag transactions or activities based on predefined criteria. While effective at catching known types of fraud, these systems are less adept at identifying upcoming, more sophisticated fraud schemes. Generative AI algorithms, on the other hand, are able to detect subtle patterns in transactions that could indicate fraud. In addition, generative AI systems can be trained to detect new types of fraud, allowing them to stay one step ahead of malicious actors. For instance, generative AI systems can detect anomalies in transaction data such as unexpected movements in amounts, or unusual patterns in customer behavior.

Generative AI models, such as Generative Adversarial Networks (GANs), can be trained on a dataset of legitimate transactions. Once trained, these models can generate synthetic transactions that resemble normal behavior. By comparing incoming transactions to these synthetic but statistically similar transactions, the system can more accurately identify anomalies that may signify fraudulent activity. The generative model augments the dataset, providing a more robust basis for detecting deviations from the norm. This allows for improved accuracy and efficiency in fraud detection, as the system is able to better identify suspicious transactions based on a more comprehensive dataset. Additionally, this reduces the reliance on manual analysis, freeing up time for analysts to focus on more complex tasks. For example, a generative model can use statistical methods to generate synthetic data with similar characteristics to the training data, allowing analysts to conduct more comprehensive tests of a system’s fraud detection capabilities.

Fraud identification through data augmentation

Data scarcity is a common challenge in fraud detection. Fraudulent activities are, by nature, rare and often dissimilar, making it difficult to train machine learning models effectively. Generative AI can mitigate this issue by creating synthetic data that resembles known fraud cases. This augmented dataset can then be used to train other machine learning models, enhancing their ability to identify fraudulent activities. Generative AI can also be used to generate new fraud cases that are not possible in the real world, providing a more comprehensive dataset for machine learning models to learn. Additionally, Generative AI can generate new data that is tailored to the specific needs of the machine learning model, allowing it to better detect fraud.

For instance, a generative model can be trained on a dataset of known phishing emails. The model can then generate new instances of phishing emails that share the same characteristics but are not exact replicas. When a machine learning model is trained on this augmented dataset, it gains a more nuanced understanding of the features that constitute phishing attempts. This improves its identification capabilities. The model can then be used to detect previously unseen phishing emails more accurately. Additionally, the model can be used to detect phishing attempts in real-time, allowing it to proactively protect your organization from potential attacks. For example, the model can be used to detect a suspicious email based on the language used, the sender’s email address, or other features indicative of a phishing attempt.

Fraud Investigation through scenario generation

Generative AI can also play a pivotal role in fraud investigations. Traditional investigative methods often involve manual data analysis and pattern recognition, which are time-consuming and subject to human error. Generative AI models can automate and enhance this process by generating plausible scenarios or data points that investigators can explore.

For example, in a case involving financial fraud, a generative model could be trained on transaction data to develop a range of scenarios that explain anomalous transactions. These generated scenarios can serve as starting points for investigators, helping them understand the possible mechanisms of the fraud scheme. This will aid in quicker resolution.

Ethical considerations

While the potential of generative AI in fraud management is immense, it is crucial to consider the ethical implications. These models generate synthetic data, which poses risks of data manipulation and misuse. Therefore, it is imperative to implement robust security measures and ethical guidelines when deploying generative AI for fraud management.

Conclusion

Generative AI holds significant promise in enhancing existing fraud prevention, identification, and investigation systems. Its ability to generate synthetic data can help overcome traditional methods’ limitations, providing a more dynamic and adaptive approach to fraud management. However, ethical considerations cannot be overlooked. As with any technological advancement, the key lies in responsible implementation and continuous monitoring to ensure that the benefits outweigh the risks.

By integrating generative AI into their cybersecurity strategies, organizations can equip themselves with a more robust and adaptive tool for combating fraud. This will safeguard their assets and reputation in an increasingly complex digital landscape.

Introduction

The Montreal College Championship is an annual soccer event involving various teams from neighborhoods across the city. The championship requires a robust database to manage information related to players, teams, sponsors, and schools. This guide will help you through the steps to create an Entity-Relationship Diagram (ERD) that serves as a blueprint for this database.

Step 1: Understand the Business Case

Before diving into the ERD, it’s crucial to understand the specific requirements and constraints of the Montreal College Championship. This involves knowing what entities are involved, what information needs to be stored, and what relationships exist among these entities.

Here is the case information supplied with the assignment:

• Montreal College Championship is a yearly soccer championship. Each neighborhood in the city has one team in this championship that is named for that neighborhood. The city council plans to develop a database to help track players and their colleges, sponsors, and teams.
• Each team has a maximum of 18 and a minimum of 12 players.
• It is not mandatory to have a player in the team, as long as the team is registered with the championship.
• No player can join the championship without being part of a team and cannot play for multiple teams.
• Each team can have one to three sponsors, and each sponsor can support multiple teams.
• Each team has a number assigned to it automatically at the beginning of the championship.
• It is important for the teams to follow the guidelines regarding the age of the players.
• In case of emergencies, teams are required to contact the schools of the players. Players will not be registered without contact information of their school.

Step 2: Identify Key Entities and Attributes

Based on the business case, identify the key entities that will be part of the ERD. For the Montreal College Championship, for example Team, player, and others. Then, since each entity will have specific attributes, identify those in the case. For example, the Team entity may have attributes like TeamID, TeamName, and AgeGuidelines. Also start looking to identify any transitional entities that may be required to avoid having any many-to-many relations. Transitional entities, also referred to a bridge or junction, may be added later, once you start seeing many-to-many relations in your ERD.

Step 3: Define the Scope

Determine the boundaries of the database you are going to design. Decide what processes or aspects of the championship the database will cover. This will help you focus on the most relevant entities and relationships. You will determine this by reading the information about the case.

Step 4: Establish Relationships and Cardinality

The next step is to establish the relationships between the entities. For example, a Team can have multiple Players, but each Player is associated with one Team. The cardinality of this relationship would be one-to-many.

Step 5: Draft the ERD

Before using any ERD software, sketch the ERD on paper. Place entities as rectangles and connect them with lines to indicate relationships. Add lines for relationships and annotate the lines with cardinality. Keep in mind the type of ERD we learned in class and that is described in the PowerPoints and the coursebook, as there are many different types. Our do not have diamonds , just entities, and relations with cardinalities.

Remember the 7 rules we saw in class:

1. Every entity must have a PK (primary key)

2.If there is no PK for an entity then you need to create one

3.A relationship between entities is always PK to FK (foreign key)

4.Only one relationship between any two entities

5.Relationships must have a cardinality on both ends

6.Many-to-many cardinalities are NOT ALLOWED and if they occur must be replaced by a transitional entity, also referred to a bridge or junction

7.No entity should be without any relationships

Step 6: Use an ERD Tool

There are various software tools available for creating ERDs, such as Lucidchart, Microsoft Visio, and draw.io. In this assignment, you are required to use VISIO to formalize your diagram. Import the entities, attributes, and relationships you’ve identified into the tool and arrange them according to best practices. Visio is available to all students on uCertify. Here’s a guide to help you:

• Go to uCertify and open Visio. You will find it in Hands-On Labs, under Visio Sandbox (item 3.1) in the labs section.
• Start the Visio sandbox in the VISIO menu on the bottom left hand side.
• Select Visio on the desktop and click twice
• Ignore any licensing message
• Open a new Visio document and select the ERD template.
• Use the shapes pane to drag and drop elements like entities and relations onto the canvas.
• Make you you have the correct cardinalities

Step 7: Validate the ERD

After creating the initial version of the ERD, it’s essential to validate it to ensure it meets the business requirements. This often involves consulting with stakeholders or experts who are familiar with the championship’s organizational aspects. You might also consider asking ChatGPT to help you validate your diagram.

Step 8: Make Revisions

Based on the feedback received, make any necessary revisions to the ERD. This could involve adding new entities, removing unnecessary attributes, or changing the nature of relationships.

Step 9: Finalize and Share

Once you’ve made all necessary revisions , share it with your team. Don’t forget to submit it later following the instructions.

Conclusion

Creating an ERD is a critical step in the database design process. It provides a visual representation of the data structure, making it easier to understand, communicate, and implement. By following these steps, you’ll be well on your way to creating a comprehensive ERD for the Montreal College Championship, ensuring that all data management needs are met effectively.

Introduction

Understanding business processes is crucial for any organization aiming for efficiency and effectiveness. One of the best ways to visualize these processes is through Business Process Model and Notation (BPMN) diagrams. In the first part of assignment 2, you will be tasked with creating a BPMN diagram based on a case study involving MMC, a company that follows a contract-based manufacturing model.

Step 1: Read and Understand the Case

Before diving into the diagram creation, it’s essential to read the case study thoroughly. Understanding the intricacies of MMC’s business model will provide you with the insights needed to create an accurate BPMN diagram. Consider breaking down the case into sections and summarizing each one to make it more manageable.

Here is the case:

MMC manufactures widgets for many industries around the Montreal area. It follows a contract-based manufacturing model where each order goes through approval by a contract agent and legal analysis by the legal department before it is fulfilled.
When the customer submits an order online, the sales department receives the request and enters it into the system. Next, the contract agent logs into the system and reviews the order. If the contract uses standard terms, the agent approves the order and sends it to the warehouse department. If the contract does not use standard terms, then the agent requests further approval from the legal department.
The legal department determines if the contract is acceptable and makes the required changes. If it is acceptable, the legal department notifies the contract agent and the agent approves the contract. If the contract is not acceptable, the legal department notifies the agent to cancel the order.
The agent then cancels the order, notifies the sales department to inform the customer. In this case, the order is never shipped. After receiving the approved order from the contract agent, the warehouse department creates the order package, updates the system, and sends it to the delivery department for shipping it to the customer.

Step 2: Identify the Actors and Their Roles

In BPMN, actors are entities that perform activities. In the case of MMC, actors include the Sales Department, Contract Agent, and others. Each has a specific role in the business process, and identifying these roles is crucial for an accurate diagram.

Step 3: Identify the Activities and Business Processes for Each Actor

Activities are the tasks performed by the actors, and they form the backbone of your BPMN diagram. For example, the Sales Department receives and enters orders, while the Contract Agent reviews and approves or disapproves them. List down these activities for each actor as they will be the primary elements in your diagram.

Step 4: Identify Any Decisions or Gateways That Need to Be Included

Decisions or gateways are points in the process where a choice must be made. In the MMC case, such decisions include whether a contract uses standard terms or needs legal review. These gateways help in directing the flow of the process and must be clearly indicated in your diagram.

Step 5: Identify the Swimlanes That Are Required

Swimlanes help in organizing your BPMN diagram by categorizing activities under the actors responsible for them. In the MMC case, each department or role would have its own swimlane, making the diagram easier to read and understand. Remember what we said in class: these can be horizontal or vertical, depending on the format of the media and how you can best use the space available, both are fine.

Step 6: Create the Diagram in Visio

Microsoft Visio is a powerful tool for creating BPMN diagrams. This is what was selected for this assignment. It is available to all students on uCertify. Here’s a guide to help you:

• Go to uCertify and open Visio. You will find it in Hands-On Labs, under Visio Sandbox (item 3.1) in the labs section.
• Start the Visio sandbox in the VISIO menu on the bottom left hand side.
• Select Visio on the desktop and click twice
• Ignore any licensing message
• Open a new Visio document and select the BPMN template.
• Use the shapes pane to drag and drop elements like actors, activities, and gateways onto the canvas.
• Connect these elements using arrows to indicate the flow of the process.
• Add swimlanes by selecting the swimlane shape and placing it on the canvas. You can then drag and drop the activities into the appropriate swimlanes.

Once your diagram is complete, it’s crucial to validate it to ensure its accuracy and completeness. Consider conducting peer reviews or using Visio’s built-in validation features to check for any inconsistencies or errors. You might also consider asking ChatGPT to help you validate your diagram.

Conclusion

Creating a BPMN diagram is not just an academic exercise; it’s a skill that can significantly aid in understanding and optimizing business processes. This guide should provide you with a structured approach to tackle the MMC case assignment effectively.

Additional Resources

For further reading and examples, you may consider attending tutoring sessions for the assignment (see the schedule on Moodle) ou use online tutorials and forums on Microsoft Visio.