Search

The ‘human factor’ is commonly considered to be the weakest link in an organization’s security chain, and a significant percentage of companies have implemented security awareness (SA) programs to address this vulnerability. However, an element whose usefulness is still underestimated is the importance to perform measurements of the different SA programs’ effectiveness in order to assess their adequateness for achieving the intended goals. This gap has serious consequences as most of the security awareness campaigns have resulted to be largely unsuccessful. Awareness measurement tools might be determinant in providing feedback on the outcome of a program as well as in helping with the strategic planning for endorsing security. This article will introduce and critically compare a set of measurement methods. It will then discuss their attributes and suggested applications.

From an engineering point of view, the survivability of a system is defined as its ability to continue to operate despite a natural or human-made disturbance; for example a serious mechanical fault, a human error, or a malicious cyber or physical attack. In the context of critical infrastructures, due to their relevance for the public wellness, it is mandatory to improve the robustness of such systems in order to ensure the availability of essential services such as the distribution of water, gas and electrical power. Nowadays, due to the increasing number of cyber incidents, the definition of protection strategies, able to improve the survivability level of this infrastructure, is at the heart of the scientific debate. In this chapter we propose a procedure based on three steps aimed at improving infrastructure survivability. In the first stage we propose some approaches to identify the criticality degree of each subsystem composing the infrastructure, in the second stage we propose a method to aggregate multiple criticality evaluations performed by subject matter experts by providing a unique holistic indicator. Finally, on the basis of such indicator, we propose a protection strategy to improve the robustness of the entire system.

In recent years, wearable sensors and smart devices, such as smartphones, smart-bands, and smart watches, are frequently adopted in order to monitor the user's physical activities. Despite the increasing accuracy of the sensors embedded in these devices, such systems are not recognized as medical devices. However, the innovation process in the context of Medicine 4.0 is proposing novel solutions based on wearable sensors, smart clothing and wireless technologies for monitoring patients in remote. At the same time, over the past few years, the most important hospitals, clinics, and medical centres invested to adopt new software platforms, such as electronic health record management systems, able to better manage the patient's medical data. In this work we want to review the main wearable solutions for activity recognition and medical devices, with the aim to analyze new perspectives based on the integration of these systems within management platforms for electronic health records.

Most critical sectors worldwide rely on operational technology (OT) whose cybersecurity, due to the primary need of availability, results to be obsolete and inadequate. Episodes like Stuxnet, Irongate, BlackEnergy3, etc., showed that cyberattacks causing kinetic effects have become a concrete threat. This is particularly concerning in relation to the chemical process industry (CPI) as disruptions could involve the release of hazardous materials and result in catastrophic effects. So far, OT-targeted cyber-attacks are considered so complex that only sophisticated teams with significant technical and organisational resources are likely to succeed. This paper provides a critical review of the most relevant elements with a focus on the petrol-chemical sector. It will first discuss why OT is inherently insecure. It will then analyse how the cyber-threat has evolved and it will review relevant OT-targeted cyberattacks. Finally, it will introduce the concept of advanced persistent threats (APT) and discuss their characterisation and modus operandi.