Matt Wheatley discusses strategic approaches to identify, analyse and address a cyber threat within an organisation, taking account of the impact of managing the risk throughout the organisation.
Summary
In the 2011 report of the Office of Cyber Security and Information Assurance of the Cabinet Office, it was found that cyber threats and cybercriminal activity has cost the United Kingdom a staggering ₤27 billion; a number prognosticated to increase unless the proper safeguards are urgently put in place. In light of this, this report will delve deeper into the concept of cyber-related threats to organisations by understanding the nature of such threats and determining the best course of action to address them.
Through the discussion of pertinent government policy papers and key literature, the report was able to draw the following conclusions regarding the nature of cyber threats:
•There are many different types of cyber threats and attacks can be intentionally perpetrated, as in the case of cybercrimes, or they can be unintentionally caused due to lenient cyber security regulations in the organisation.
•The primary difficulty in mitigating cyber threats is the sheer volume of possible actors, the anonymity provided by the internet, the diversity of ways to perpetrate an attack, and the unpredictability of cyber threats.
•Given the complexity of cyber threats as a criminal and technological concept, a multi-faceted and holistic solution is necessary to curb its occurrence.
With a better understanding of the nature of cyber threats and after reviewing the current national strategy for cyber security, the following recommendations are made for organisations wishing to fortify their cyber security infrastructure:
•First, there must be a concerted effort to create an organisational culture that recognises the value of cyber vigilance in light of the immense detriments that cyber-attacks can cause to the organisation.
•Second, the organisation must constantly update its current security infrastructure, making sure that it has the most effective safeguards against malicious cyber activities.
•Finally, organisations must also actively interface with the government, heeding their help in helping fortify cyber defences while also trying to help them in making the nation’s networks more secure.
Introduction
With the ever-growing capacity of the internet, companies have gradually transitioned towards greater dependence on its infrastructure to allow for easier data management and consumer interfacing and insight (Castells, 2011). In the case of the United Kingdom, the rise of the internet has allowed internet-related businesses to reap around ₤82 billion each year (Kearney, 2012). Moreover, it has also been found that almost 20% of all profits earned by a company are now derived from internet-based transactions (Kearney, 2012). For the largest companies, the internet has become their lifeblood, providing useful applications ranging from social media management to data storage in the cloud (Rangan and Adner, 2012). Nevertheless, while the internet opens a world of possibilities, it also opens a world of threats.
1.1 The Reality of Cyber Threats Today
In a survey conducted by the UK’s Department of Business, Innovations, and Skills (2013) on companies listed on the FTSE 350, it was found that 14% of these companies are constantly considering the threat of cyber-attacks with 25% classifying cyber threats as one of their top risks. In another study, the UK Home Office (2013) found that in 2012, among the four industries surveyed, businesses reported a total of 180,000 incidents of online crime, mostly launched in the form of malicious viruses.
The financial costs of cyber-attacks are debilitating as well. In a report released by the Office of Cyber Security and Information Assurance (2011) under the auspice of the UK Cabinet Office, the total estimated cost of all cybercrimes perpetrated against businesses in the UK is ₤27 billion. The 2011 report highlights the fact that, not only is this a significant number, it is also bound to grow if private organisations and the government fail to put the necessary safeguards in place.
Statistics add to the clamour to find a more potent approach to preventing cyber threats, or to at least alleviate the damage they cause to companies and organisations. To this end, the UK government has launched a more stringent set of guidelines on cyber transactions and security to combat the rise of cybercrime activity and to address cyber threats (Office of Cyber Security and Information Assurance, 2011).
1.2 Report Objectives and Methodology
The overarching goal of this report is to provide a fuller picture of the nature of cyber threats and cybercrimes perpetrated against organisations. As has been shown, there is a need to address the costs and damages of these crimes and in order to respond effectively, it is necessary to have a better understanding of relevant conceptual and practical underpinnings. Thus, related concepts such as the difficulty in mitigating cyber threats and current strategies to address them will also be expounded on in this report.
So as to cover the topic expansively, literature from the past 10 years will be reviewed and discussed throughout the paper. The timescale was selected to provide adequate diversity in the studies covered while making sure that the discussion remains relevant and timely. In addition to these studies, government white paper and policy reports will also be resourced. The discussion will be specifically contextualised in the United Kingdom.
1.3 Report Outline and Layout
In this section, the background of the topic has been elaborated on as well as the approach taken for this report. In the succeeding sections, the following related topics shall also be discussed:
•Chapter 2 of this report will focus on understanding the nature of cyber threats and the different types of threats that exist. It will also cover the primary challenges in dealing with such threats.
•Chapter 3 involves a discussion of the current strategies that have been put in place to deter the occurrence of cyber threats in the UK. It will also present and discuss other strategies that can be applied.
•Chapter 4 ends the report by synthesising the key points into conclusions. In addition to this, based on the material covered, recommendations will also be made for organisations fighting against cyber threats.
2. The Nature of Cyber Threats
This chapter will delve deeper into the nature of cyber threats and the many different ways these threats can manifest. The aim of the chapter is to provide a sense of the complex nature of cyber threats, how they can be very different from one another and why mitigating them can be difficult. The UK House of Commons Home Affairs Committee (2013) provided a three pronged definition of cybercrime:
•‘Pure’ online crimes, where a digital system is the target as well as the means of attack. These include attacks on computer systems to disrupt IT infrastructure, and stealing data over a network using malware (the purpose of the data theft is usually to enable further crime);
•‘Existing’ crimes that have been transformed in scale or form by their use of the internet. The growth of the internet has allowed these crimes to be carried out on an industrial scale; and
•Use of the internet to facilitate drug dealing, people smuggling and many other ‘traditional’ types of crime. (House of Commons Home Affairs Committee, 2013, p.4).
Note that cybercrimes fall within a subset of cyber threats. In general, a cyber threat can be any act, whether intentional or unintentional, that aims to cause detriment to an organisation (Choo, 2011). In this sense, cybercrimes fall within the bracket of intentional cyber threats. The different types of cyber threats that exist will be discussed in greater detail in the rest of this chapter.
2.1 The Types of Cyber Threats
As has been previously stated, there are many different forms of cyber threats. However, this report will specifically focus on the five most common threats. These are: the use of phishing or spear phishing; the use of malicious code; the existence of weak passwords; the insistence to use outdated software; and the continual interfacing of removable media (Gretizer et al., 2008).
What is truly alarming, however, is that as complex hardware and software become more accessible, so do more complex forms of cyber threats (Levi, 2008). This means that organisations must constantly be vigilant against such threats, as will be elaborated upon later in the report. In the next sections, the discussion will move towards understanding why addressing cyber threats can be difficult.
2.2 The Difficulty in Mitigating Cyber Threats
The primary question that needs to be addressed is why it has been so difficult for society to address the issue of cyber threats thus far. Given how detrimental it has proven to organisations and individuals around the world, there must have already been sufficient clamour for a stronger means of addressing the problem. The reality, however, is that inasmuch as there have been efforts launched to minimise the occurrence of cyber threats and to enact laws that would provide harsher punishments for cyber criminality, there are nonetheless various complexities that make the issue far more difficult to solve (Greitzer et al., 2011).
The first problem in addressing cyber threats is the fact that there are so many possible actors who can perpetrate an attack (Yar, 2005). In the case of organisations, the perpetrator could be an employee or a stranger from half-way around the world. The fact that computer technology has become more and more affordable and the fact that the internet is a democratic product that can freely be accessed by anyone means that, when desired and motivated to do so, numerous individuals can become actors of cybercrime (Yar, 2005). To add to this, the sheer scope of the internet itself provides a veil of anonymity and security and, although tracking can be done, not all organisations have the necessary equipment to do so (Wall, 2007).
Furthermore, the wide range of perpetrators also means that there are a wide range of motives from which cyber threats can draw (Ophardt, 2010). Attacks can range from classic industry attacks that include data scanning systems for espionage and competitive advantage, to militaristic espionage in the case of government networks (Katos and Bednar, 2008). In fact, one of the most alarming motives for cyber threats is cyber terrorism. While such attacks have been few and far between, they still constantly raise fear in many defence pundits, as a potent cyber terrorist attack could cause massive network blackouts and data loss (Brenner, 2004).
Securing an organisation against cyber threats is also complicated by the diverse ways in which the attacks can be launched (Brenner, 2007). Perpetrators can utilise many of the common attack vectors such as e-mails or direct network hacking, which take advantage of many of the security weaknesses of the organisation’s network (Sukhai, 2004). This further compounds the problem of tracking the primary actors of a crime because many of the cyber attack techniques available are very similar, which means that a distinguishable trademark that would help identify actors would be difficult to pinpoint—and all this done under the internet’s veil of anonymity (Yang and Hoffstadt, 2006).
The final hurdle in mitigating the problem of cyber threats in organisations is the unpredictability of attack scope and effect (Karyda and Mitrou, 2007). Organisations can constantly pad network security safeguards but predicting how and by how much a cyber attack will affect an organisation’s operations is near impossible (Sommer, 2004). This is especially challenging given the fact that some cyber infiltration methods for industry sabotage may not necessarily need to extract data; instead, hackers can subtly alter data, which means that an attack may not even be detected by the organisation but data alteration can have serious detrimental effects in the long run (Karyda and Mitrou, 2007).
The complex web of difficulties that harangue the mitigation of cyber threats does not mean that it is entirely impossible to avoid their occurrence. It does, however, show that a single mode response to cyber threats would be inadequate and that a holistic and multi-modal solution is needed.
2.3 Cyber Threats and the Breakdown of Traditional Policing
One of the key deterrents for crime, in general, is the possibility of getting caught. This means that if cybercriminals are aware that they can be tracked and implicated for their acts, it can at least reduce the number of threats launched towards an organisation (Brenner, 2007). Traditional policing, however, necessitates that one determines who did the crime and why they would do it, both of which are extremely complex questions in the expansive field of the internet (Brenner, 2004). Essentially, this points to the need to rethink current models of policing and security enforcement in the face of cyber threats.
As has been emphasised, being able to attribute a cyber attack to an individual or a group is a difficult task; nevertheless, cyber security efforts should focus on developing technologies that are able to address this difficulty because it is only through this that proper responses to cybercrime, such as criminal liabilities, could be made (Ophardt, 2010). Experts note that in the case of cyber threats, the question is no longer only about the absolute determination of who did it. Instead, they note that it is sufficient to know who the probable actors are and the manner by which they could have executed the act (Decker, 2007). This is still a murky construct, given that instead of implicating individuals, the approach casts a wider net, which may not fall within the confines of traditional criminal codes (Decker, 2007).
While the exact approach may not yet be completely clear, the discussion on problem areas in addressing cybercrime provides a solid foundation from which resultant action can take place.
2.4 Chapter Synthesis
In this chapter, the focus has been to delve deeper into the nature of cyber threats. To this end, the different types of cyber threats were identified and discussed. Following this, it was shown why cyber threats are difficult to fight against and mitigate in the sense that they exist in a very distinct and complex context that traditional policing frameworks are not yet able to fully address. Therefore, the chapter posits that, in the face of the breakdown of traditional approaches, innovative and multi-faceted solutions are necessary to address the rise of cyber threats.
3. Combating the Rise of Cyber Threats
Given that the nature of cybercrimes and cyber threats have already been discussed in the previous chapter, the goal of this chapter is to provide an outline of how such threats can be combated. To do this, a discussion on the current UK Cyber Security Strategy will be undertaken, providing ample focus on its objectives and an analysis of its current direction. Beyond this, several other essential means by which cyber threats can be mitigated will be elaborated upon.
3.1 The UK Cyber Security Strategy
In light of the capacious dependence on the internet by both individuals and businesses, the UK Cyber Security Strategy was launched in 2011 to guide efforts towards safeguarding cyberspace, which is purported to be a space of social and economic value (Luiij, Besseling, Spoelstra and de Graaf, 2013). The strategy outlines key objectives towards achieving a more secure cyberspace in 2015. According to the UK Cabinet Office:
Our vision is for the UK in 2015 to derive huge economic and social value from a vibrant, resilient and secure cyberspace, where our actions, guided by our core values of liberty, fairness, transparency and the rule of law, enhance prosperity, national security and a strong society (2011, p. 21).
Beyond this, the strategy sets four distinct objectives that seek to ground the vision by providing concrete action points through which the vision can be realised. In the rest of this section, the discussion shall focus on what these four objectives intend to achieve in light of the need for greater cyber security.
3.1.1 Objective 1: Tackling cybercrime and making the UK one of the most secure places in the world to do business.
In the case of this objective, the goal is to work with the Home Office to provide a reduction in the current online vulnerability of businesses in the UK (Von Solms and Van Niekerk, 2013). More specifically, this entails lobbying for a more stringent application of laws against cyber threat activities by pushing UK courts to create appropriate sanctions for such offences (Slocombe, 2013). The objective also calls for a specialised division of cybercrime and cyber threat specialists to fortify and supplement the efforts of the National Crime Agency. This would entail the recruitment of so-called “cyber-specials” who are more knowledgeable in tracking and detecting instances of cyber threats (Healey, Rohmeyer, Sachs, Schimdt and Weiss, 2012). Finally, the objective also calls for the current review of legislation relevant to cyber threats and to update them in light of developments concerning the matter to maintain their potency in combating these threats (Healey et al., 2012).
3.1.2 Objective 2: Making the UK more resilient to cyber attack and better able to protect our interests in cyberspace.
In this objective, the focus lies on the national level and how terrorist activities perpetrated through the cyberspace can have undeniably detrimental effects to the nation’s defences and economy (Chun, 2013). To address this, the objective calls for greater government involvement in private institutions to assist them in developing cyber security safeguards to prevent or mitigate the economic and national impact of cyber attack from terrorists and other criminal entities (O’Connell, 2012). Additionally, the objective also aims to create a cyber security network with other nations under the North Atlantic Treaty Organisation, akin to the present agreement of mutual defence (O’Connell, 2012).
3.1.3 Objective 3: Hoping to shape an open, vibrant, and stable cyberspace which the UK public can support safely and which supports open societies.
While the previous two objectives aim to tighten security networks, this objective assures that inasmuch as such measures are to be undertaken, the fundamental freedoms involved in the use of the internet shall not be curtailed (Choucri and Goldsmith, 2012). For this to take shape, a concerted effort from various pertinent national and international bodies must convene to develop a set of international norms of accepted behaviour in cyberspace (Lehto, Huhtinen and Jantunen, 2011).
3.1.4 Objective 4: Building the UK’s cross-cutting knowledge, skills, and capability to underpin all cyber security objectives.
The first two objectives focused on governmental action to provide cyber security; the third moved on to the promotion of free expression in the midst of such security; and the last objective went on to discuss the necessary knowledge base to achieve such a secure cyberspace (Hoffman, Burley and Toregas, 2012). In particular, this objective is focused on crafting a targeted research agenda to supplement the efforts to tighten cyber security by providing the necessary technical capacities to better anticipate, implicate, and track cyber threats (Hoffman et al., 2012).
3.1.5 Analysing the Objectives
The UK Cyber Security Strategy is comprehensive in that it takes all possible aspects and issues surrounding the notion of cyber threats and addresses them appropriately. However, the primary problem with the current system is its fixation on government policy and oversight. While it is true that strong government involvement is necessary to provide change across the board, too much government involvement may disempower the private sector which has just as much cause to promote cyber security (Ghernouti-Hélie, 2010). While the Strategy does mention interfacing with businesses and companies, it is passive in nature in that government merely consults and provides information and infrastructure to these companies rather than creating an effective partnership.
The problem with such limited involvement of the private sector is that it will not help to spur structural change (Carin, Cybenko and Hughes, 2008). While the policies and rules stemming from the Strategy may provide guidance for cyber security in the future, making sure that the sense of urgency and vigilance feeds down to each individual working for the organisation is needed for a more sustainable effect (Hansen and Nissenbaum, 2009).
3.2 Beyond Technical Measures
Clearly, technological advancement and research is a critical part of providing better security to counter cyber threats, as can be gleaned from the final objective of the UK Cyber Security Strategy. However, there are also several facets of cyber security – that are just as invaluable – that go beyond the sphere of technology. Being able to cultivate and inculcate these into an organisation’s cyber security framework will more sustainably aid the organisation in battling the threats that beset cyberspace.
3.2.1 The Value of Cultural Change
Almost every person in an organisation or nation uses some form of information communication technology (ICT) to accomplish their day-to-day needs. Given that each individual is connected to the network they must, therefore, display a certain sense of vigilance with regard to their responsibility in safeguarding the sanctity of the network (Rigby and Bilodeau, 2013). In this sense, the government and private organisations alike must carry out education campaigns to empower individuals to take on their roles as stewards of cyberspace; the intent being so that they are not tempted to act as a passive audience while larger players attempt to combat possible cyber threats (Pred, Pfleeger, Hunker and Bulford, 2008).
Such a perspective also emphasises how seemingly unpredictable cyber attacks can be as they may be initiated at any moment through any means against an organisation (Pred et al., 2008). In this sense, such mundane lapses as clicking a suspicious link or leaving behind a thumb drive can have serious repercussions for the organisation. The actions of employees are affected by organisational cultures and these are the sort of security breaches that a culture of cyber vigilance is able to prevent (Wheatley, 2014).
3.2.2 Creating Equitable Partnerships
As has been mentioned, the central problem area of the UK Cyber Security Strategy is the passive role that the private sector plays and, in contrast, the overbearing scope of government’s involvement (Etzioni, 2011). In order to assuage such a disproportionality in the relationship, the government must aspire for a more equitable partnership with the private sector. In this sense, mutual knowledge sharing and management is necessary. That is, while government seeks to reinforce the network security of the private sector, so too must the private sector involve itself in helping the government’s research initiatives to better fight cyber criminals (Harknet and Stever, 2009).
Such a relationship built on mutual benefit would enhance the framework provided by the current strategy of the UK. Not only will the private sector play a more active role in curbing the occurrence of cyber threats, government will inevitably benefit from the resources that the private sector can share (Harknet and Stever, 2009). Only a truly multi-institutional approach can make a difference to the prevention of cyber threats.
3.3 Chapter Synthesis
In this chapter, the discussion was centred on providing strategies to help fight against cyber threats. The primary source of strategic insight was the UK Cyber Security Strategy. In this light, the objectives and vision of the Strategy was described and an analysis concerning problem areas of the Strategy were identified. To end, the chapter also provided additional perspectives to supplement current strategies in making a more sustainable and potent action against cyber threats.
4. Conclusions and Recommendations
In this report, the focus has been to provide a comprehensive discussion on the nature of cyber threats and the current strategies viable for use in organisations to counter such threats. It has been established that cyber threats and cyber criminality introduce a complex and unique dimension in criminology for which traditional policing and current criminal codes are not able to properly litigate. In particular, the following key insights were made regarding the nature of cyber threats:
•There are many different types of cyber threats and they can be intentionally perpetrated, as in the case of cybercrimes, or they can be unintentionally caused due to lenient cyber security regulations in the organisation.
•The primary difficulty in mitigating cyber threats is the sheer volume of possible actors, the anonymity provided by the internet, the diversity of ways to perpetrate an attack, and the unpredictability of cyber threats.
•Given the complexity of cyber threats as a criminal and technological concept, a multi-faceted and holistic solution is necessary to curb its occurrence.
Given the realisation of the complexity of cyber threats and the difficulty of truly eliminating such risks in the context of the organisation, the following strategies are recommended to alleviate the danger of cyber threats in the organisation:
•First, there must be a concerted effort to create an organisational culture that sees the value of cyber vigilance in light of the immense detriments that cyber attacks can cause towards the organisation.
•Second, the organisation must constantly update its current security infrastructure, making sure that it has the most effective safeguards against malicious cyber activities.
•Finally, organisations must also actively interface with the government, heeding their help in helping fortify cyber defences while also trying to help them in making the nation’s networks more secure.
The given recommendations are multi-faceted and multi-institutional, which is necessary in order to combat cyber threats on all fronts and to reduce the staggering costs that businesses have experienced due to this pervasive and expanding problem.
References
References
August, T. and Tunca, T. I. (2011). ‘Who should be responsible for software security? A comparative analysis of liability policies in network environments.’ Management Science, 57(5), pp. 934-959.
Bayer, U., Moser, A., Kruegel, C. and Kirda, E. (2006). ‘Dynamic analysis of malicious code.’ Journal in Computer Virology, 2(1), pp. 67-77.
Brackney, R. C. and Anderson, R. H. (2004). Understanding the Insider Threat: Proceedings of a March 2004 Workshop (Vol. 196). Santa Monica, CA: Rand Corporation.
Brenner, S. W. (2004). ‘Cybercrime Metrics: Old Wine, New Bottles?’ Virginia Journal of Law and Technology, 9(13), pp. 1-52.
Brenner, S. W. (2007). ‘” At Light Speed”: Attribution and Response to Cybercrime/Terrorism/Warfare.’ The Journal of Criminal Law and Criminology, 97(2), pp. 379-475.
Carin, L., Cybenko, G. and Hughes, J. (2008). ‘Cybersecurity strategies: The queries methodology.’ Computer, 41(8), pp. 20-26.
Castells, M. (2011). The Rise of the Network Society: The Information Age: Economy, Society, and Culture (Vol. 1). New York, NY: John Wiley & Sons.
Cazier, J. A. and Medlin, B. D. (2006). ‘Password security: An empirical investigation into e-commerce passwords and their crack times.’ Information Systems Security, 15(6), pp. 45-55.
Choo, K. K. R. (2011). ‘The cyber threat landscape: Challenges and future research directions.’ Computers & Society, 30(8), pp. 719-731.
Choucri, N. and Goldsmith, D. (2012). ‘Lost in cyberspace: Harnessing the Internet, international relations, and global security.’ Bulletin of the Atomic Scientists, 68(2), pp. 70-77.
Chun, K. H. (2013). ‘Cyber Security and the Military’s Role: The UK and Its Response.’ The Korean Journal of Security Affairs, 18(1), pp. 43-61.
Decker, C. (2007). ‘Cyber Crime 2.0: An Argument to Update the United States Criminal Code to Reflect the Changing Nature of Cyber Crime.’ Southern California Law Review, 81, pp. 959-1016.
Department of Business, Innovations, and Skills (2013). FTSE 350 Cyber Governance Health Check: Tracker Report. London: Department of Business, Innovations, and Skills.
Downs, J. S., Holbrook, M. B. and Cranor, L. F. (2006, July). ‘Decision strategies and susceptibility to phishing.’ Proceedings of the Second Symposium on Usable Privacy and Security (pp. 79-90): Association for Computing Machinery.
Etzioni, A. (2011). ‘Cybersecurity in the private sector.’ Issues in Science and Technology, 28(1), pp. 58-62.
Geer, D. (2005). ‘Malicious bots threaten network security.’ Computer, 38(1), pp. 18-20.
Ghernouti-Hélie, S. (2010, February). ‘A national strategy for an effective cybersecurity approach and culture.’ Availability, Reliability, and Security, 2010. ARES’ 10 International Conference, (pp. 370-373): Institute of Electrical and Electronics Engineers.
Greitzer, F. L., Moore, A. P., Cappelli, D. M., Andrews, D. H., Carroll, L. A. and Hull, T. D. (2008). ‘Combating the insider cyber threat.’ Security & Privacy, 6(1), pp. 61-64.
Hansen, L. and Nissenbaum, H. (2009). ‘Digital disaster, cyber security, and the Copenhagen School.’ International Studies Quarterly, 53(4), pp. 1155-1175.
Harknett, R. J. and Stever, J. A. (2009). ‘The cybersecurity triad: Government, private sector partners, and the engaged cybersecurity citizen.’ Journal of Homeland Security and Emergency Management, 6(1), pp. 455-460.
Healey, J., Rohmeyer, P., Sachs, M. H., Schmidt, J. and Weiss, J. (2012). Cyber Security Policy Guidebook. New York, NY: John Wiley & Sons.
Herley, C., van Oorschot, P. C. and Patrick, A. S. (2009). ‘Passwords: If we’re so smart, why are we still using them?’ Financial Cryptography and Data Security (pp. 230-237): Springer Berlin Heidelberg.
Hoffman, L., Burley, D. and Toregas, C. (2012). ‘Holistically Building the Cybersecurity Workforce.’ Security & Privacy, 10(2), pp. 33-39.
Home Office (2013). Crime Against Businesses: Headline Findings from the 2012 Commercial Victimisation Survey. London: Home Office.
House of Commons Home Affairs Committee. (2013). E-Crime: Fifth Report of Session 2013-2013. London: The Stationery Office Limited.
Jagatic, T. N., Johnson, N. A., Jakobsson, M. and Menczer, F. (2007). ‘Social phishing.’ Communications of the ACM, 50(10), pp. 94-100.
Karyda, M. and Mitrou, L. (2007, August). ‘Internet forensics: Legal and technical issues.’ IEEE Second International Workshop on Digital Forensics and Incident Analysis: Institute of Electrical and Electronics Engineers.
Katos, V. and Bednar, P. M. (2008). ‘A cyber-crime investigation framework.’ Computer Standards & Interfaces, 30(4), pp. 223-228.
Kearney, A. T. (2012). The Internet Economy in the United Kingdom. Chicago, IL: A. T. Kearney.
Lehto, M., Huhtinen, A. M. and Jantunen, S. (2011). ‘The Open Definition of Cyber: Technology or a Social Construction?’ International Journal of Cyber Warfare and Terrorism, 1(2), pp. 1-9.
Levi, M. (2008). ‘White-collar, organised and cyber crimes in the media: some contrasts and similarities.’ Crime, Law and Social Change, 49(5), pp. 365-377.
Luiijf, H. A. M., Besseling, K., Spoelstra, M. and de Graaf, P. (2013). ‘Ten National Cyber Security Strategies: A Comparison.’ Critical Information Infrastructure Security (pp. 1-17): Springer Berlin Heidelberg.
Malin, C. H., Casey, E. and Aquilina, J. M. (2008). Malware Forensics: Investigating and Analyzing Malicious Code. Boston, MA: Syngress.
O’Connell, M. E. (2012). ‘Cyber security without cyber war.’ Journal of Conflict and Security Law, 17(2), pp. 187-209.
Ophardt, J. A. (2010). ‘Cyber Warfare and the Crime of Aggression: The Need for Individual Accountability on Tomorrow’s Battlefield.’ Duke Law & Technology Review 9(3), pp. 1-28.
Predd, J., Pfleeger, S. L., Hunker, J. and Bulford, C. (2008). ‘Insiders behaving badly.’ Security & Privacy, 6(4), pp. 66-70.
Rangan, S. and Adner, R. (2012). ‘Profits and the Internet: Seven misconceptions.’ MIT Sloan Management Review, 42(4), pp. 44-53.
Rigby, D. and Bilodeau, B. (2013). Management Tools & Trends 2013. Boston, MA: Bain & Company.
Saini, H., Rao, Y. S. and Panda, T. C. (2012). ‘Cyber-crimes and their impacts: A review.’ International Journal of Engineering Research & Applications, 2(2), pp. 202-209.
Slocombe, G. (2013). ‘Cyber security—A vital part of national security.’ Asia-Pacific Defence Reporter, 39(2), pp. 31-34.
Sommer, P. (2004). ‘The future for the policing of cybercrime.’ Computer Fraud & Security, 2004(1), pp. 8-12.
Sridhar, S., Hahn, A. and Govindarasu, M. (2012). ‘Cyber–physical system security for the electric power grid.’ Proceedings of the IEEE, 100(1), pp. 210-224.
Sukhai, N. B. (2004, October). ‘Hacking and cybercrime.’ Proceedings of the 1st Annual Conference on Information Security Curriculum Development (pp. 128-132): Association for Computing Machinery.
Trevino, C. M., Veitch, C. K., Michalski, J., Harris, J. M., Maruoka, S. and Frye, J. (2012). Cyber Threat Metrics. Albuquerque, NM: Sandia National Laboratories.
United Kingdom (UK) Cabinet Office (2011). The UK Cyber Security Strategy: Protecting and promoting the UK in a digital world. London: Cabinet Office, [online]. Retrieved from: www.gov.uk/government/uploads/system/uploads/attachment_data/file/60961/uk-cyber-security-strategy-final.pdf.
Von Solms, R. and Van Niekerk, J. (2013). ‘From information security to cyber security.’ Computers & Security, 38, pp. 97-102.
Wall, D. (2007). Cybercrime: The Transformation of Crime in the Information Age, (Vol. 4). Cambridge, UK: Polity.
Wheatley, M. (2014). What is effective information security? Professional Security Magazine. Retrieved from: https://professionalsecurity.co.uk/news/training/what-is-effective-information-security/
Yang, D. W. and Hoffstadt, B. M. (2006). ‘Countering the cyber-crime threat.’ American Criminal Law Review, 43, 201-215.
Yar, M. (2005). ‘The novelty of ‘cybercrime: an assessment in light of routine activity theory.’ European Journal of Criminology, 2(4), pp. 407-427.
