首页 > 最新文献

The Oxford Handbook of Cyber Security最新文献

英文 中文
Managing Risk 风险管理
Pub Date : 2021-11-04 DOI: 10.1093/oxfordhb/9780198800682.013.8
A. Corbeil, Rafal Rohozinski
The Internet and social media platforms are disrupting societies and politics on a global level. While these technologies have had immense benefit, facilitating individual empowerment and establishing the data economy, they have also helped to mainstream terrorism, hate, and anti-democratic beliefs. These forces will continue to disrupt traditional democratic politics and contribute to the breakdown of societal cohesion. Regulations that ensure the protection of fundamental rights and freedoms are now a necessary element in the establishment of a new social contract for the digital age. Stakeholders must work to reimpose gatekeeper functions that the Internet has swept away, in turn limiting the ability of dangerous marginal views to influence the mainstream. However, in doing so, these same stakeholders must ensure that their efforts do not result in an Orwellian future that leaves citizens less secure and less empowered.
互联网和社交媒体平台正在全球范围内扰乱社会和政治。虽然这些技术带来了巨大的好处,促进了个人赋权和建立了数据经济,但它们也助长了恐怖主义、仇恨和反民主信仰的主流。这些势力将继续破坏传统的民主政治,并导致社会凝聚力的瓦解。确保保护基本权利和自由的法规现在是为数字时代建立新的社会契约的必要因素。利益相关者必须努力重新发挥互联网已经被扫除的看门人职能,从而限制危险的边缘观点影响主流的能力。然而,在这样做的过程中,这些利益相关者必须确保他们的努力不会导致一个奥威尔式的未来,让公民更不安全,更没有权力。
{"title":"Managing Risk","authors":"A. Corbeil, Rafal Rohozinski","doi":"10.1093/oxfordhb/9780198800682.013.8","DOIUrl":"https://doi.org/10.1093/oxfordhb/9780198800682.013.8","url":null,"abstract":"The Internet and social media platforms are disrupting societies and politics on a global level. While these technologies have had immense benefit, facilitating individual empowerment and establishing the data economy, they have also helped to mainstream terrorism, hate, and anti-democratic beliefs. These forces will continue to disrupt traditional democratic politics and contribute to the breakdown of societal cohesion. Regulations that ensure the protection of fundamental rights and freedoms are now a necessary element in the establishment of a new social contract for the digital age. Stakeholders must work to reimpose gatekeeper functions that the Internet has swept away, in turn limiting the ability of dangerous marginal views to influence the mainstream. However, in doing so, these same stakeholders must ensure that their efforts do not result in an Orwellian future that leaves citizens less secure and less empowered.","PeriodicalId":336846,"journal":{"name":"The Oxford Handbook of Cyber Security","volume":"34 3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116491740","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Making Sense of Cybersecurity in Emerging Technology Areas 理解新兴技术领域的网络安全
Pub Date : 2021-11-04 DOI: 10.1093/oxfordhb/9780198800682.013.6
C. Vishik, M. Huth, Lawrence John, M. Balduccini
Shortening technology development cycles in information and communication technology (ICT) make it imperative to anticipate the emergence and evolution of new computing technologies and ecosystems. A wide range of questions must be answered to ensure that new technology environments are viable, including the examination of usability, efficiency, usage models, security, and privacy. These contextual aspects of new technologies are essential for their adoption. They are also important to understanding the potential of new types of cybercrime and requirements for the development of mitigation techniques. However, we lack methodologies to model and predict the features of the evolving ICT ecosystems, and the requirements their evolution places on legal systems and regulatory frameworks. The absence of such models is a significant obstacle to creating consistent approaches necessary to forecast both the technology development and the trends in cybercrime. The chapter discusses which potential methodologies could be used for forecasting cybersecurity concerns in disruptive technology areas and trends in cybercrime in complex environments. It proposes that a unified approach should be developed for predicting cybersecurity effects of innovative technologies and trends in cybercrime. It first examines concepts associated with emerging technologies and their impact on cybersecurity. It then looks at approaches to modelling and analysis already developed in adjacent spaces, with a focus on knowledge representation and risk engineering, and analyses representative examples to illustrate the benefits these approaches can bring.
信息和通信技术(ICT)技术开发周期的缩短使得预测新计算技术和生态系统的出现和演变势在必行。为了确保新技术环境的可行性,必须回答一系列广泛的问题,包括对可用性、效率、使用模型、安全性和隐私性的检查。新技术的这些上下文方面对于它们的采用至关重要。它们对于了解新型网络犯罪的潜力和开发缓解技术的要求也很重要。然而,我们缺乏方法来模拟和预测不断发展的ICT生态系统的特征,以及它们的演变对法律制度和监管框架的要求。缺乏这样的模型是创建预测技术发展和网络犯罪趋势所必需的一致方法的一个重大障碍。本章讨论了哪些潜在的方法可用于预测颠覆性技术领域的网络安全问题和复杂环境中网络犯罪的趋势。报告建议,应该制定统一的方法来预测创新技术对网络安全的影响和网络犯罪的趋势。它首先考察了与新兴技术相关的概念及其对网络安全的影响。然后,它着眼于在相邻空间中已经开发的建模和分析方法,重点是知识表示和风险工程,并分析代表性示例来说明这些方法可以带来的好处。
{"title":"Making Sense of Cybersecurity in Emerging Technology Areas","authors":"C. Vishik, M. Huth, Lawrence John, M. Balduccini","doi":"10.1093/oxfordhb/9780198800682.013.6","DOIUrl":"https://doi.org/10.1093/oxfordhb/9780198800682.013.6","url":null,"abstract":"Shortening technology development cycles in information and communication technology (ICT) make it imperative to anticipate the emergence and evolution of new computing technologies and ecosystems. A wide range of questions must be answered to ensure that new technology environments are viable, including the examination of usability, efficiency, usage models, security, and privacy. These contextual aspects of new technologies are essential for their adoption. They are also important to understanding the potential of new types of cybercrime and requirements for the development of mitigation techniques. However, we lack methodologies to model and predict the features of the evolving ICT ecosystems, and the requirements their evolution places on legal systems and regulatory frameworks. The absence of such models is a significant obstacle to creating consistent approaches necessary to forecast both the technology development and the trends in cybercrime. The chapter discusses which potential methodologies could be used for forecasting cybersecurity concerns in disruptive technology areas and trends in cybercrime in complex environments. It proposes that a unified approach should be developed for predicting cybersecurity effects of innovative technologies and trends in cybercrime. It first examines concepts associated with emerging technologies and their impact on cybersecurity. It then looks at approaches to modelling and analysis already developed in adjacent spaces, with a focus on knowledge representation and risk engineering, and analyses representative examples to illustrate the benefits these approaches can bring.","PeriodicalId":336846,"journal":{"name":"The Oxford Handbook of Cyber Security","volume":"22 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122799217","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
The Role of Defence in National Cybersecurity 国防在国家网络安全中的作用
Pub Date : 2021-11-04 DOI: 10.1093/oxfordhb/9780198800682.013.27
Mika Kerttunen
Essential to states organizing and regulating civil-military relations, the author analyses the actual and potential role and tasks that the defence sector and armed forces can take up in national cybersecurity policy and strategy. After identifying competences and capabilities that the defence sector could employ for national cybersecurity, the chapter identifies generic roles, from being an independent actor to being another integrated stakeholder, for the defence sector and the armed forces. The author notices how inclusion of the defence sector into national cybersecurity updates the concerns of the ‘military-industrial complex’ influencing not only cybersecurity policy but also how information and communication technologies are to be used in a society. Therefore, the chapter ultimately encourages states to implement strong political control in order to avoid unnecessary securitization and militarization of information technology and cyber development policies, misuse of public mandate and funds, and, ultimately, abuses of power by any elite.
对于国家组织和规范军民关系至关重要,作者分析了国防部门和武装部队在国家网络安全政策和战略中可以发挥的实际和潜在作用和任务。在确定了国防部门可用于国家网络安全的能力和能力之后,本章确定了国防部门和武装部队的一般角色,从独立行为者到另一个综合利益相关者。作者注意到,将国防部门纳入国家网络安全更新了“军工复合体”的关注,不仅影响网络安全政策,还影响信息和通信技术在社会中的使用方式。因此,本章最终鼓励各国实施强有力的政治控制,以避免不必要的信息技术和网络发展政策的证券化和军事化,滥用公共授权和资金,并最终避免任何精英滥用权力。
{"title":"The Role of Defence in National Cybersecurity","authors":"Mika Kerttunen","doi":"10.1093/oxfordhb/9780198800682.013.27","DOIUrl":"https://doi.org/10.1093/oxfordhb/9780198800682.013.27","url":null,"abstract":"Essential to states organizing and regulating civil-military relations, the author analyses the actual and potential role and tasks that the defence sector and armed forces can take up in national cybersecurity policy and strategy. After identifying competences and capabilities that the defence sector could employ for national cybersecurity, the chapter identifies generic roles, from being an independent actor to being another integrated stakeholder, for the defence sector and the armed forces. The author notices how inclusion of the defence sector into national cybersecurity updates the concerns of the ‘military-industrial complex’ influencing not only cybersecurity policy but also how information and communication technologies are to be used in a society. Therefore, the chapter ultimately encourages states to implement strong political control in order to avoid unnecessary securitization and militarization of information technology and cyber development policies, misuse of public mandate and funds, and, ultimately, abuses of power by any elite.","PeriodicalId":336846,"journal":{"name":"The Oxford Handbook of Cyber Security","volume":"53 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122248387","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Cyberwar Redux 网络战争回来的
Pub Date : 2021-11-04 DOI: 10.1093/oxfordhb/9780198800682.013.14
B. Buchanan
The notion of cyberwar has held a central place in technology and security scholarship for several decades. With the continued aggression of modern government hacking operations, cyberwar has again emerged as a popular frame. This chapter shows how the present reality, though, has strayed far from the original concept and how a closer examination of state activities suggests a scope for hacking that is different and more limited than many expected. Drawing on case studies, this chapter shows how virtually all hacking activities fall short of war. They are instead variants of espionage, sabotage, and subversion. This refined framing offers important implications for deterrence, coercion, and operational practice.
几十年来,网络战的概念一直在技术和安全学术领域占据核心地位。随着现代政府黑客行动的持续侵略,网络战再次成为一个流行的框架。本章展示了当前的现实是如何与最初的概念相去甚远的,以及对国家活动的更仔细研究如何表明,黑客活动的范围与许多人预期的不同,也更有限。通过案例研究,本章展示了几乎所有的黑客活动都没有达到战争的程度。相反,它们是间谍、破坏和颠覆的变体。这种精细化的框架为威慑、胁迫和操作实践提供了重要的含义。
{"title":"Cyberwar Redux","authors":"B. Buchanan","doi":"10.1093/oxfordhb/9780198800682.013.14","DOIUrl":"https://doi.org/10.1093/oxfordhb/9780198800682.013.14","url":null,"abstract":"The notion of cyberwar has held a central place in technology and security scholarship for several decades. With the continued aggression of modern government hacking operations, cyberwar has again emerged as a popular frame. This chapter shows how the present reality, though, has strayed far from the original concept and how a closer examination of state activities suggests a scope for hacking that is different and more limited than many expected. Drawing on case studies, this chapter shows how virtually all hacking activities fall short of war. They are instead variants of espionage, sabotage, and subversion. This refined framing offers important implications for deterrence, coercion, and operational practice.","PeriodicalId":336846,"journal":{"name":"The Oxford Handbook of Cyber Security","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131749902","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Cybersecurity, Multilateral Export Control, and Standard Setting Arrangements 网络安全、多边出口管制和标准制定安排
Pub Date : 2021-11-04 DOI: 10.1093/oxfordhb/9780198800682.013.30
Elaine Korzak
This chapter focuses on two trade mechanisms and their role in pursuing the policy imperatives of promoting international trade in information and communication technologies (ICTs) while seeking to mitigate cybersecurity risks. The first mechanism, international standard setting and certification efforts, aims to facilitate international trade by providing benchmarks and assurances for security features. In contrast, the second mechanism, international export controls, explicitly seeks to restrict the trade in certain ICT goods for national and international security purposes. The chapter begins by introducing the concepts of standards and certification, and surveying the landscape of cybersecurity standard setting before providing a discussion of the major intergovernmental certification scheme, the Common Criteria Recognition Arrangement. It then looks at the Wassenaar Arrangement and examines its recent experience in bringing two types of technologies, intellectual property (IP) surveillance systems and intrusion software, under the purview of export controls.
本章重点介绍两种贸易机制及其在促进信息通信技术(ict)国际贸易、同时寻求降低网络安全风险的政策要求方面的作用。第一个机制是国际标准制定和认证工作,旨在通过提供安全特征的基准和保证来促进国际贸易。相比之下,第二种机制,即国际出口管制,明确寻求出于国家和国际安全目的限制某些信息通信技术产品的贸易。本章首先介绍了标准和认证的概念,并调查了网络安全标准制定的情况,然后讨论了主要的政府间认证计划,即共同标准认可安排。然后,本文研究了《瓦森纳协定》(Wassenaar Arrangement),并分析了其最近在将两种技术——知识产权监控系统和入侵软件——纳入出口管制范围方面的经验。
{"title":"Cybersecurity, Multilateral Export Control, and Standard Setting Arrangements","authors":"Elaine Korzak","doi":"10.1093/oxfordhb/9780198800682.013.30","DOIUrl":"https://doi.org/10.1093/oxfordhb/9780198800682.013.30","url":null,"abstract":"This chapter focuses on two trade mechanisms and their role in pursuing the policy imperatives of promoting international trade in information and communication technologies (ICTs) while seeking to mitigate cybersecurity risks. The first mechanism, international standard setting and certification efforts, aims to facilitate international trade by providing benchmarks and assurances for security features. In contrast, the second mechanism, international export controls, explicitly seeks to restrict the trade in certain ICT goods for national and international security purposes. The chapter begins by introducing the concepts of standards and certification, and surveying the landscape of cybersecurity standard setting before providing a discussion of the major intergovernmental certification scheme, the Common Criteria Recognition Arrangement. It then looks at the Wassenaar Arrangement and examines its recent experience in bringing two types of technologies, intellectual property (IP) surveillance systems and intrusion software, under the purview of export controls.","PeriodicalId":336846,"journal":{"name":"The Oxford Handbook of Cyber Security","volume":"526 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130240077","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Personal Protection 个人防护
Pub Date : 2021-11-04 DOI: 10.1093/oxfordhb/9780198800682.013.22
D. Clemente
This chapter examines the basics of personal cybersecurity and good ‘cyber hygiene’. It analyses the trade-offs inherent in cybersecurity, looks at methods of conducting a risk assessment, and reveals the potential impacts of poor security choices. It offers a range of practical security recommendations applicable to informed readers who may not be subject matter experts, and who wish to manage their personal cyber risks more effectively.
本章探讨个人网络安全和良好“网络卫生”的基础知识。它分析了网络安全固有的权衡,研究了进行风险评估的方法,并揭示了糟糕的安全选择的潜在影响。它提供了一系列实用的安全建议,适用于那些可能不是主题专家、希望更有效地管理个人网络风险的知情读者。
{"title":"Personal Protection","authors":"D. Clemente","doi":"10.1093/oxfordhb/9780198800682.013.22","DOIUrl":"https://doi.org/10.1093/oxfordhb/9780198800682.013.22","url":null,"abstract":"This chapter examines the basics of personal cybersecurity and good ‘cyber hygiene’. It analyses the trade-offs inherent in cybersecurity, looks at methods of conducting a risk assessment, and reveals the potential impacts of poor security choices. It offers a range of practical security recommendations applicable to informed readers who may not be subject matter experts, and who wish to manage their personal cyber risks more effectively.","PeriodicalId":336846,"journal":{"name":"The Oxford Handbook of Cyber Security","volume":"72 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124444945","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
The ‘Insider Threat’ and the ‘Insider Advocate’ “内部威胁”和“内部倡导者”
Pub Date : 2021-11-04 DOI: 10.1093/oxfordhb/9780198800682.013.21
M. Steinmetz
Discussion of the insider threat gains more attention every day. Much of the debate concerns the dysfunctional actions and behaviours of the malicious insider, whose ability to cause harm commands headlines on a regular basis. Technological strides have been made to identify the behaviours that could locate the malicious insider threat and even predict the likelihood of such behaviours before they take place. This chapter addresses areas beyond those frequently explored when discussing the methods and means of discovering dysfunctional behaviour by examining the entire workforce and the factors affecting the entire workplace environment. Are there opportunities where leadership could better measure and shape the work environment, thereby creating a different work environment for employees? What happens when companies fail to utilize every metric available and every opportunity to shape the work environment? Are there opportunities not just to identify the malicious insider threat but to create measurable insider advocacy?
关于内部威胁的讨论每天都得到越来越多的关注。大部分争论都是关于恶意内部人员的不正常行为和行为,他们造成伤害的能力经常占据头条新闻。在识别可以定位恶意内部威胁的行为,甚至在此类行为发生之前预测其可能性方面,技术已经取得了长足的进步。本章讨论了通过检查整个劳动力和影响整个工作场所环境的因素来发现功能失调行为的方法和手段时经常探讨的领域。领导层是否有机会更好地衡量和塑造工作环境,从而为员工创造不同的工作环境?如果公司不能利用每一个可用的指标和每一个机会来塑造工作环境,会发生什么?是否有机会不仅识别恶意的内部威胁,而且创造可衡量的内部倡导?
{"title":"The ‘Insider Threat’ and the ‘Insider Advocate’","authors":"M. Steinmetz","doi":"10.1093/oxfordhb/9780198800682.013.21","DOIUrl":"https://doi.org/10.1093/oxfordhb/9780198800682.013.21","url":null,"abstract":"Discussion of the insider threat gains more attention every day. Much of the debate concerns the dysfunctional actions and behaviours of the malicious insider, whose ability to cause harm commands headlines on a regular basis. Technological strides have been made to identify the behaviours that could locate the malicious insider threat and even predict the likelihood of such behaviours before they take place. This chapter addresses areas beyond those frequently explored when discussing the methods and means of discovering dysfunctional behaviour by examining the entire workforce and the factors affecting the entire workplace environment. Are there opportunities where leadership could better measure and shape the work environment, thereby creating a different work environment for employees? What happens when companies fail to utilize every metric available and every opportunity to shape the work environment? Are there opportunities not just to identify the malicious insider threat but to create measurable insider advocacy?","PeriodicalId":336846,"journal":{"name":"The Oxford Handbook of Cyber Security","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129017416","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Toward a Vulnerability Mitigation Model 迈向漏洞缓解模型
Pub Date : 2021-11-04 DOI: 10.1093/oxfordhb/9780198800682.013.39
José Eduardo M. S. Brandão
This chapter demonstrates how the elements of a cybersecurity incident can be analysed systematically, and suggests an alternative way to mitigate the causes and consequences of such incidents. Cybersecurity incidents can be explained in terms of a sequence of elements linking the attacking agents to their objectives: the attacking agent uses tools to exploit vulnerabilities, causing actions on a specific target to obtain unauthorized results, achieving their objectives. Cyber security can be improved by stopping the flow of the attack by mitigating one or more elements that make up the process. Unfortunately, most of these elements have characteristics that limit the opportunities for mitigation. The least difficult element to mitigate is vulnerability. The current model of vulnerability mitigation has behaved for the corporate environment, which can pay for specialized tools and consulting. This is an excellent business model but inaccessible to the public. A new model is necessary to prevent cybersecurity incidents on a broader, more inclusive level. The main proposal for vulnerability mitigation is multisector cooperation to create an independent, trustworthy, and secure vulnerability database, based on a new vulnerability report protocol developed in accordance with researchers, companies, governments, and society. However, this proposal creates some social, political, and technical challenges.
本章演示了如何系统地分析网络安全事件的要素,并提出了减轻此类事件的原因和后果的替代方法。网络安全事件可以用一系列将攻击代理与其目标联系起来的元素来解释:攻击代理使用工具利用漏洞,对特定目标进行操作,以获得未经授权的结果,从而实现其目标。网络安全可以通过减少构成攻击过程的一个或多个元素来阻止攻击流,从而得到改善。不幸的是,这些因素中的大多数都具有限制缓解机会的特点。最容易减轻的因素是脆弱性。目前的漏洞缓解模式适用于企业环境,企业环境可以支付专门工具和咨询费用。这是一种优秀的商业模式,但公众无法接触到。为了在更广泛、更包容的层面上预防网络安全事件,需要一种新的模式。缓解脆弱性的主要建议是开展多部门合作,根据研究人员、公司、政府和社会共同制定的新的脆弱性报告协议,创建一个独立、可信和安全的脆弱性数据库。然而,这一提议带来了一些社会、政治和技术方面的挑战。
{"title":"Toward a Vulnerability Mitigation Model","authors":"José Eduardo M. S. Brandão","doi":"10.1093/oxfordhb/9780198800682.013.39","DOIUrl":"https://doi.org/10.1093/oxfordhb/9780198800682.013.39","url":null,"abstract":"This chapter demonstrates how the elements of a cybersecurity incident can be analysed systematically, and suggests an alternative way to mitigate the causes and consequences of such incidents. Cybersecurity incidents can be explained in terms of a sequence of elements linking the attacking agents to their objectives: the attacking agent uses tools to exploit vulnerabilities, causing actions on a specific target to obtain unauthorized results, achieving their objectives. Cyber security can be improved by stopping the flow of the attack by mitigating one or more elements that make up the process. Unfortunately, most of these elements have characteristics that limit the opportunities for mitigation. The least difficult element to mitigate is vulnerability. The current model of vulnerability mitigation has behaved for the corporate environment, which can pay for specialized tools and consulting. This is an excellent business model but inaccessible to the public. A new model is necessary to prevent cybersecurity incidents on a broader, more inclusive level. The main proposal for vulnerability mitigation is multisector cooperation to create an independent, trustworthy, and secure vulnerability database, based on a new vulnerability report protocol developed in accordance with researchers, companies, governments, and society. However, this proposal creates some social, political, and technical challenges.","PeriodicalId":336846,"journal":{"name":"The Oxford Handbook of Cyber Security","volume":"28 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125553267","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Cyberweapons
Pub Date : 2021-11-04 DOI: 10.1093/oxfordhb/9780198800682.013.9
Sandro Gaycken
This chapter explains tactical offensive cyberoperations to derive a precise definition of cyberweapons. The definition will be used to explore implementable options for cyber arms control and functional cyber norms, it will help to delineate important research gaps and red lines and to identify novel options for an application of international humanitarian law to strategic cyberwarfare, such as an application of the human shield rule to ban commercial information technology from military units.
本章解释了战术进攻性网络作战,以得出网络武器的精确定义。该定义将用于探索网络军备控制和功能性网络规范的可实施选项,它将有助于划定重要的研究空白和红线,并确定将国际人道主义法应用于战略网络战的新选项,例如应用人盾规则禁止军事单位使用商业信息技术。
{"title":"Cyberweapons","authors":"Sandro Gaycken","doi":"10.1093/oxfordhb/9780198800682.013.9","DOIUrl":"https://doi.org/10.1093/oxfordhb/9780198800682.013.9","url":null,"abstract":"This chapter explains tactical offensive cyberoperations to derive a precise definition of cyberweapons. The definition will be used to explore implementable options for cyber arms control and functional cyber norms, it will help to delineate important research gaps and red lines and to identify novel options for an application of international humanitarian law to strategic cyberwarfare, such as an application of the human shield rule to ban commercial information technology from military units.","PeriodicalId":336846,"journal":{"name":"The Oxford Handbook of Cyber Security","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122285119","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Getting Beyond Norms 超越常规
Pub Date : 2021-11-04 DOI: 10.1093/oxfordhb/9780198800682.013.36
Melissa Hathaway
In recent years, countries have become increasingly concerned about the immediate and future threats to their critical services and infrastructures that could result from the misuse of information and communications technologies (ICTs). As such, countries have placed the development of normative standards guiding state behaviour in cyberspace at the top of their foreign policy agendas. Yet, despite broad international consensus regarding the basic principles to limit the misuse of ICTs in the digital age and to constrain state behaviour, the key tenets have been consistently violated. All evidence suggests that states are not following their own doctrines of restraint, and that each disruptive and destructive attack further destabilizes our future. States have turned a blind eye and have shirked their responsibility for curbing or halting cyberattacks originating from their own territories. Disruption or damage (or both) of critical infrastructures that provide services to the public has become customary practice—the ‘new normal’. And this intentional misuse of ICTs against critical infrastructures and services has great potential to lead to misperception, escalation, and even conflict. This chapter offers five standards of care that can be used to ‘test’ individual states’ true commitment to the international norms of behaviour. Only with a concerted and coordinated effort across the global community will it be possible to change the new normal of ‘anything goes’ and move forward to ensure the future safety and security of the Internet and Internet-based infrastructures.
近年来,各国越来越关注滥用信息通信技术(ict)可能对其关键服务和基础设施造成的当前和未来威胁。因此,各国已将制定指导网络空间国家行为的规范性标准置于其外交政策议程的首位。然而,尽管国际社会就限制在数字时代滥用信息通信技术和约束国家行为的基本原则达成了广泛共识,但这些关键原则却不断遭到违反。所有证据都表明,各国没有遵循自己的克制原则,每一次破坏性和破坏性的攻击都进一步破坏了我们的未来。各国对此睁一只眼闭一只眼,逃避遏制或制止源自本国领土的网络攻击的责任。为公众提供服务的关键基础设施遭到破坏或破坏(或两者兼而有之)已成为惯例——“新常态”。这种针对关键基础设施和服务的故意滥用信息通信技术的行为极有可能导致误解、升级甚至冲突。本章提供了五个可用于“检验”各国对国际行为准则的真正承诺的关注标准。只有国际社会同心协力,共同努力,才能改变“一切皆有可能”的新常态,才能确保互联网及互联网基础设施的未来安全。
{"title":"Getting Beyond Norms","authors":"Melissa Hathaway","doi":"10.1093/oxfordhb/9780198800682.013.36","DOIUrl":"https://doi.org/10.1093/oxfordhb/9780198800682.013.36","url":null,"abstract":"In recent years, countries have become increasingly concerned about the immediate and future threats to their critical services and infrastructures that could result from the misuse of information and communications technologies (ICTs). As such, countries have placed the development of normative standards guiding state behaviour in cyberspace at the top of their foreign policy agendas. Yet, despite broad international consensus regarding the basic principles to limit the misuse of ICTs in the digital age and to constrain state behaviour, the key tenets have been consistently violated. All evidence suggests that states are not following their own doctrines of restraint, and that each disruptive and destructive attack further destabilizes our future. States have turned a blind eye and have shirked their responsibility for curbing or halting cyberattacks originating from their own territories. Disruption or damage (or both) of critical infrastructures that provide services to the public has become customary practice—the ‘new normal’. And this intentional misuse of ICTs against critical infrastructures and services has great potential to lead to misperception, escalation, and even conflict. This chapter offers five standards of care that can be used to ‘test’ individual states’ true commitment to the international norms of behaviour. Only with a concerted and coordinated effort across the global community will it be possible to change the new normal of ‘anything goes’ and move forward to ensure the future safety and security of the Internet and Internet-based infrastructures.","PeriodicalId":336846,"journal":{"name":"The Oxford Handbook of Cyber Security","volume":"69 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121682238","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
期刊
The Oxford Handbook of Cyber Security
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1