Search

The weaponization of artificial intelligence (AI) and machine learning (ML) models in cybersecurity is a growing concern, with cybercriminal organizations and nation-states exploiting their weaknesses. The Microsoft "Tay" chatbot incident exemplifies the risks of weaponized AI, as it displayed sexist and racist behaviors due to malicious data inputs. The researcher examined 21 academic studies on AI weaponization and AI-driven cyberattacks in this systematic review. This work, a systematic review, concludes with an in-depth understanding of the scale and scope of using AI as a cyber weapon. The findings revealed that more research is necessary on weaponizing AI for offensive cybersecurity applications and the following key observations (a) a connection between AI weaponization and countermeasures, (b) AI's role in enhancing cybersecurity defenses, (c) AI weaponization offering mitigation strategies for protecting digital assets and infrastructure, and (d) AI-driven attacks exploiting vulnerabilities, enabling automation and scalability, facilitating data poisoning and manipulation, improving social engineering, and augmenting evasion obfuscation. This study contributes to a better understanding of AI weaponization and aids researchers in synthesizing current literature on the topic. [ABSTRACT FROM AUTHOR]

Social engineering addresses a broad category of techniques aiming to persuade someone to reveal data or perform actions for criminal purposes, such as disclosing personal information about a particular target. Cybersecurity awareness is required to raise people's understanding of how these social engineering techniques are being used and so their capacity to exploit them. To accomplish this objective, primary focus is given to educating and training individuals on how to recognize such incidents and respond to them effectively. To protect people against social engineering threats, various cybersecurity models and approaches have been proposed. There are, however, a few differences between these models, since they are developed for specific purposes. Thus, the main objective of this study is to develop a cybersecurity awareness model specifically designed for Saudi students to protect them from social engineering attacks. The design science methodology was utilized in this study. The proposed model consists of four main stages: education and training, developing policies and guidelines, improving Saudi schools' security, as well as monitoring and evaluation. The model introduced can ensure the safety and privacy of students, teachers, and staff across different social platforms. [ABSTRACT FROM AUTHOR]

Social engineering attacks are considered one of themost hazardous cyberattacks in cybersecurity, as human vulnerabilities are often the weakest link in the entire network. Such vulnerabilities are becoming increasingly susceptible to network security risks. Addressing the social engineering attack defense problem has been the focus of many studies. However, two main challenges hinder its successful resolution. Firstly, the vulnerabilities in social engineering attacks are unique due to multistage attacks, leading to incorrect social engineering defense strategies. Secondly, social engineering attacks are real-time, and the defense strategy algorithms based on gaming or reinforcement learning are too complex to make rapid decisions. This paper proposes a multiattribute quantitative incentive method based on human vulnerability and an improved Q-learning (IQL) reinforcement learning method on human vulnerability attributes. The proposed algorithm aims to address the two main challenges in social engineering attack defense by using a multiattribute incentive method based on human vulnerability to determine the optimal defense strategy. Furthermore, the IQL reinforcement learning method facilitates rapid decision-making during real-time attacks. The experimental results demonstrate that the proposed algorithm outperforms the traditional Qlearning (QL) and deep Q-network (DQN) approaches in terms of time efficiency, taking 9.1% and 19.4% less time, respectively. Moreover, the proposed algorithm effectively addresses the non-uniformity of vulnerabilities in social engineering attacks and provides a reliable defense strategy based on human vulnerability attributes. This study contributes to advancing social engineering attack defense by introducing an effective and efficient method for addressing the vulnerabilities of human factors in the cybersecurity domain. [ABSTRACT FROM AUTHOR]

Emailing is among the cheapest and most easily accessible platforms, and covers every idea of the present century like banking, personal login database, academic information, invitation, marketing, advertisement, social engineering, model creation on cyber-based technologies, etc. The uncontrolled development and easy access to the internet are the reasons for the increased insecurity in email communication. Therefore, this review paper aims to investigate deep learning approaches for detecting the threats associated with e-mail security. This study compiles the literature related to the deep learning methodologies, which are applicable for providing safety in the field of cyber security of email in different organizations. Relevant data were extracted from different research depositories. The paper discusses various solutions for handling these threats. Different challenges and issues are also investigated for e-mail security threats including social engineering, malware, spam, and phishing in the existing solutions to identify the core current problem and set the road for future studies. The review analysis showed that communication media is the common platform for attackers to conduct fraudulent activities via spoofed e-mails and fake websites and this research has combined the merit and demerits of the deep learning approaches adaption in email security threat by the usage of models and technologies. The study highlighted the contrasts of deep learning approaches in detecting email security threats. This review study has set criteria to include studies that deal with at least one of the six machine models in cyber security. [ABSTRACT FROM AUTHOR]

Business Email Compromise (BEC) attacks have emerged as serious threats to organizations in recent years, exploiting social engineering and malware to dupe victims into divulging confidential information and executing fraudulent transactions. This paper provides a comprehensive review of BEC attacks, including their principles, techniques, and impacts on enterprises. In light of the rising tide of BEC attacks globally and their significant financial impact on business, it is crucial to understand their modus operandi and adopt proactive measures to protect sensitive information and prevent financial losses. This study offers valuable recommendations and insights for organizations seeking to enhance their cybersecurity posture and mitigate the risks associated with BEC attacks. Moreover, we analyze the Greek landscape of cyberattacks, focusing on the existing regulatory framework and the measures taken to prevent and respond to cybercrime in accordance with the NIS Directives of the EU. By examining the Greek landscape, we gain insights into the effectiveness of countermeasures in this region, as well as the challenges and opportunities for improving cybersecurity practices. [ABSTRACT FROM AUTHOR]

Purpose: The purpose of the work was to discuss various forms of social engineering and to conduct a survey among the academic community in the field of cybersecurity. Design/methodology/approach: Survey was conducted by google forms. Findings: The paper discusses the issue of social engineering and its types, such as: phishing, pharming, vishing, whaling, skimming and rubber ducky devices. Subsequently, "good practices", i.e. recommendations to be used in order to increase security against a cyberattack, were discussed. In the research part, a survey was conducted among the academic community. 111 respondents took part in the survey. The answers were analyzed and conclusions were drawn. Research among the academic community on cybersecurity awareness has been conducted for the first time. The results show the level of awareness and demand for cybersecurity training. Social implications: The survey was aimed at examining the awareness of the academic community in the field of cybersecurity. Based on the responses, it can be concluded that the demand for training in this area is high. [ABSTRACT FROM AUTHOR]

Cyber Security has gained a significant amount of perceived importance when talking about the risks and challenges that lie ahead in the field of information technology. A recent increase in high-profile incidents involving any form of cyber criminality have raised the awareness of threats that were formerly often hidden from public perception, e.g., with openly carried out attacks against critical infrastructure to accompany traditional forms of warfare, extending those to the cyberspace. Add to that very personal experience of everyday social engineering attacks, which are cast out like a fishing net on a large scale, e.g., to catch anyone not careful enough to double-check a suspicious email. But as the threat level rises and the attacks become even more sophisticated, so do the methods to mitigate (or at least recognize) them. Of central importance here are methods from the field of machine learning (ML). This article provides a comprehensive overview of applied ML methods in cyber security, illustrates the importance of ML for cyber security, and discusses issues and methods for generating good datasets for the training phase of ML methods used in cyber security. This includes own work on the topics of network traffic classification, the collection of real-world attacks using honeypot systems as well as the use of ML to generate artificial network traffic. [ABSTRACT FROM AUTHOR]

The need for cyber security is growing every day as the amount of data available online continues to rise exponentially. The cyber security has become a field of prime importance in the recent years and will continue to be so. Hackers and malpractitioners are growing day by day and are using varied methods and techniques to extract information of prime importance from the users. "Phishing" is one of the most common yet unique security concern. It is unique in the way that instead of targeting the system vulnerabilities, it is a social engineering attack targeting human vulnerabilities. Users give up their personal and sensitive data viz. passwords, card details, bank details etc. by falling to scam emails or websites. The target of this research is to create a tool which will help to detect and differentiate a phishing website from a safe website, thus preventing users into opening risky URLs and keeping their personal data safe. Linear Regression and MultinomialNB are used as the prime methods for the classification apart from other techniques viz. Random Forest, Artificial Neural Network and Support Vector Machine. Most common machine learning algorithms require intensive training of data, causing the process to become slow in order to be executed in real time. The aim of the research is to create a model that can work in real time. The designed pipelined model using Logistic regression, achieved an accuracy of around 98%. [ABSTRACT FROM AUTHOR]

Copyright of International Journal of Legal Studies ( IJOLS ) is the property of International Institute of Innovation Science-Education-Development in Warsaw and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Copyright of Revue Electronique Internationale Pour la Publication de Recherches Juridiques is the property of Revue Electronique Internationale Pour la Publication de Recherches Juridiques and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Copyright of Cuestiones Políticas is the property of Revista Cuestiones Politicas and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

This article advocates using the RASCLS v Ransomware (RvR) framework to detect, defend against, and defeat cyber-attacks. RvR employs conventional counterintelligence practices such as the traditional MICE+ G and more modern RASCLS counterintelligence framework to detect, defend against, and defeat cyber-attacks. The MICE+ G framework holds that people betray their organizations and countries because of money (financial problems or goals), ideology (beliefs), coercion/compromise, ego/extortion, and grievances. RASCLS offers similar rationales: reciprocation, authority, scarcity, commitment/consistency, liking (befriending), and social proof. [ABSTRACT FROM AUTHOR]

The article discusses the potential security and privacy risks associated with Central Bank Digital Currencies (CBDCs). Topics discussed include cybersecurity threats to individual accounts and centralized ledgers, the distinction between CBDCs and cryptocurrencies, and strategies for ensuring robust security and privacy in CBDC systems.

Blockchain, smart contracts, and related concepts have emerged in recent years as a promising technology for cryptocurrency, NFTs, and other areas. However, there are still many security issues that must be addressed as these technologies evolve. This paper reviews some of the leading social engineering attacks on smart contracts, as well as several vulnerabilities which result from insecure code development. A smart contract test bed is constructed using Solidity and a Metamask wallet to evaluate vulnerabilities such as insecure arithmetic, denial of service, and re-entrancy attacks. Cross-chain vulnerabilities and potential vulnerabilities resulting from layer 2 side-chain processing were also investigated. Mitigation best practices are proposed based on the experimental results. [ABSTRACT FROM AUTHOR]

This study was conducted to assess the cybersecurity preparedness of a college-level population. As the world becomes more dependent on computers, it becomes more essential and more difficult to protect them. While bad actors are certainly capable of infiltrating a system without inside help, the number of attacks initiated by simple poor computer safety hygiene far outweighs all other attack methods. Given that universities have digital access to not only the personally identifying information (PII), but also the academic and professional work of thousands of people, they are particularly tempting targets. This experiment was undertaken to learn how likely a university is to fall prey to a cyberattack, in an effort to guard against real attacks in the future. The results demonstrated a disconnect between cybersecurity best practices and whom the practices are built to protect, with the target university’s population being snared by a simple, low effort, and easily avoidable attack vector: “infected” USB drives. [ABSTRACT FROM AUTHOR]

As a result of the developments in science and technology, all our living spaces, from health, education, and trade to our social life, have been moved to the digital environment. With this process, artificial intelligence, which is the ultimate goal of creating systems that think and act like human beings, has started to be used in all areas of our lives. This study focuses on gender determination by using artificial intelligence algorithms on voice data. Thanks to this determination, significant contributions will be made in various fields such as social engineering and cyber security such as fraud, person detection, and advertising investments. In the analysis of the study, R application, a completely open-source, for various artificial intelligence algorithms has been used. In this way, a solution has been provided to take the security as mentioned above measures with low cost instead of highcost systems and increase the sales figures in areas such as marketing. In the study, supervised learning artificial intelligence algorithms have been examined. The artificial intelligence analysis results of the study have shown that the gender of the person could be determined above % 97 successful rates through the voice data. [ABSTRACT FROM AUTHOR]

Recently, phishing attacks have become one of the most prominent social engineering attacks faced by public internet users, governments, and businesses. In response to this threat, this paper proposes to give a complete vision to what Machine learning is, what phishers are using to trick gullible users with different types of phishing attacks techniques and based on our survey that phishing emails is the most effective on the targeted sectors and users which we are going to compare as well. Therefore, more effective phishing detection technology is needed to curb the threat of phishing emails that are growing at an alarming rate in recent years, thus will discuss the techniques of mitigation of phishing by Machine learning algorithms and technical solutions that have been proposed to mitigate the problem of phishing and valuable awareness knowledge users should be aware to detect and prevent from being duped by phishing scams. In this work, we proposed a detection model using machine learning techniques by splitting the dataset to train the detection model and validating the results using the test data , to capture inherent characteristics of the email text, and other features to be classified as phishing or non-phishing using three different data sets, After making a comparison between them, we obtained that the most number of features used the most accurate and efficient results achieved. the best ML algorithm accuracy were 0.88, 1.00, and 0.97 consecutively for boosted decision tree on the applied data sets. [ABSTRACT FROM AUTHOR]

Copyright of Methaodos: Social Science Journal / Methaodos: Revista de Ciencias Sociales is the property of Departamento de Ciencias de la Comunicacion y Sociologia, Universidad Rey Juan Carlos and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

This study explores the challenge of cyber security threats that e-commerce technology and business are facing. Technology applications for e-commerce are attracting attention from both academia and industry. It has made what was not possible before for the business community and consumers. But it did not come all alone but has brought some challenges, and cyber security challenge is one of them. Cyber security concerns have many forms, but this study focuses on social engineering, denial of services, malware, and attacks on personal data. Firms worldwide spend a lot on addressing cybersecurity issues, which grow each year. However, it seems complicated to overcome the challenge because the attackers continuously search for new vulnerabilities in humans, organizations, and technology. This paper is based on the conceptual analysis of social engineering, denial of services, malware, and attacks on personal data. We argue that implementing modern technology for e-commerce and cybersecurity issues is a never-ending game of cat and mouse. To reduce risks, reliable technology is needed, training of employees and consumer is necessary for using the technology, and a strong policy and regulation is needed at the firm and governmental level. [ABSTRACT FROM AUTHOR]

The emergence of the COVID-19 pandemic in early 2020 has transformed how individuals work and learn and how they can apply cyber-security requirements in their, mostly remote, environments. This transformation also affected the university student population; some needed to adjust to new remote work settings, and all needed to adjust to the new remote study environment. In this online research study, we surveyed a large number of university students (n = 798) to understand their expectations in terms of support and help for this new remote work and study environment. We also asked students to report on their practices regarding remote location and Wi-Fi security settings, smart home device usage, BYOD (bring your own device) and personal device usage and social engineering threats, which can all lead to compromised security. A key aspect of our work is a comparison between the practices of students having work experience with the practices of students having no such additional experience. We identified that both the expectations and the level of cyber-security awareness differ significantly between the two student populations and that cyber-security awareness is increased by work experience. Work experience students are more aware of the cyber-security risks associated with a remote environment, and a higher portion of them know the dedicated employee whom they can contact in the event of incidents. We present the organizational security practices through the lens of employees with initial work experience, contributing to a topic that has so far received only limited attention from researchers. We provide recommendations for remote study settings and also for remote work environments, especially where the existing research literature survey results differ from the findings of our survey. [ABSTRACT FROM AUTHOR]

In recent years, ransomware attacks have become increasingly rampant by the offenders for which ransomware has maintained a major cyber security threat as time progresses. With paradigm shift from social to technical factors, ransomware has also maintained the equal adaptiveness by shifting its focus from initial days' scareware and locker attacks to most recent crypto-ransomware threats. There is no silver bullet available to wipe out completely crypto-ransomware attacks for its obvious relationships between social engineering which investigates more infections with encrypted malware. Bitcoin, a means of digital payment demanded by Ransomware family needs characterization and analysis to predict the cryptoransomware attack types. In this paper, at first, contractive autoencoder (CAE) is used on bitcoin transaction dataset for dimensionality reduction as a filter approach in order to obtain a reduced yet a powerful representation of the raw data and then the output of CAE is applied to the classifier for its improved performance and to make it a robust model. We use two classifiers for our experiments namely: Resilient KNN and Fuzzy Lattice Reasoning (FLR). The original KNN classifier was successful in dealing with homogenous data where the values of the numerical attribute exist completely but poses limitations while dealing with heterogeneous incomplete data containing mixed data (numeric and categorical) yet having missing values. Further, KNN used same K values for all the query objects that sometimes leads to misclassification. Resilient KNN is proposed in this paper to deal with these pitfalls effectively by assigning different k-values for different query objects, so as to obtain a most accurate predictive model. Next, the FLR is used for its ability to handle different types of data types and moreover, it is incremental and fast learning which tempted us to explore its possibility in detecting the crypto-ransomware attacks efficiently. The experimental results with several conventional and new evaluation metrics justifies the suitability of our proposed approach in building a robust and efficient classifier model to detect crypto ransomware families in comparison to existing research. [ABSTRACT FROM AUTHOR]

Although the Internet of Things (IoT) developers view human users as the weakest cybersecurity link and potentially a deciding factor in IoT security, IoT devices are exposed to a variety of security flaws and vulnerabilities, which most social engineers take advantage of to launch several data-collection attacks. For various purposes, this study looked at improving data security on MySQL databases and web pages by using TSL encryption protocols and the two algorithms (RSA & AES) that correlate with the Internet of Things environment and enable user authentication. The implementation was done on the proposed models and encryption methods used. This study aimed to protect the information that is shared on the Internet and connect IoT devices in a secure environment. The results revealed that the proposed study increased the level of protection with the help of complex conditions specified when registering the user and protecting it against attacks. As a result, one of the most important events that came true is the existence of cybersecurity. It is expected that this research will enhance the understanding of the IoT environment and exploit social engineering attacks to impose security on the IoT environment and preserve the rights of human users. [ABSTRACT FROM AUTHOR]

Assessing security awareness among users is essential for protecting industrial control systems (ICSs) from social engineering attacks. This research aimed to determine the effect of cyber security awareness on the emergency response to cyber security incidents in the ICS. Additionally, this study has adopted a variety of cyber security emergency response process measures and frameworks and comprehensively proposes a new organizational model of cyber security incident response. The corresponding measures are evaluated based on the MP2DR2 risk control matrix model to assess their practical value in the evaluation stage. This study found that after adding security awareness measures to response control measures, the influential value ranking of other control measures changed. The practical value of security awareness control measures was given a higher priority than that of other control measures. The research results highlight the importance of cyber security awareness and aim to inspire ICSs to place a higher priority on staff cyber security awareness in relation to cyber security incidents, which can effectively prevent the occurrence of cyber security incidents and make the field of industrial control application agency respond to incidents faster to restore the regular progress of all works. [ABSTRACT FROM AUTHOR]

Today's threats use multiple means of propagation, such as social engineering, email, and application vulnerabilities, and often operate in different phases, such as single device compromise, lateral network movement, and data exfiltration. These complex threats rely on advanced persistent threats supported by well-advanced tactics for appearing unknown to traditional security defenses. As organizations realize that attacks are increasing in size and complexity, cyber threat intelligence (TI) is growing in popularity and use. This trend followed the evolution of advanced persistent threats, as they require a different level of response that is more specific to the organization. TI can be obtained via many formats, with open-source intelligence one of the most common, and using threat intelligence platforms (TIPs) that aid organizations to consume, produce, and share TI. TIPs have multiple advantages that enable organizations to quickly bootstrap the core processes of collecting, analyzing, and sharing threat-related information. However, current TIPs have some limitations that prevent their mass adoption. This article proposes AECCP, a platform that addresses some of the TIPs limitations. AECCP improves quality TI by classifying it accordingly a single unified taxonomy, removing the information with low value, enriching it with valuable information from open-source intelligence sources, and aggregating it for complementing information associated with the same threat. AECCP was validated and evaluated with three datasets of events and compared with two other platforms, showing that it can generate quality TI automatically and help security analysts analyze security incidents in less time. [ABSTRACT FROM AUTHOR]

Phishing is a cybercrime that is increasing exponentially day by day. In phishing, a phisher employs social engineering and technology to misdirect victims towards revealing their personal information, which can then be exploited. Despite ongoing research to find effective anti-phishing solutions, phishing remains a serious security problem for Internet users. In this paper, an investigation of using CAPTCHA keystroke dynamics to enhance the prevention of phishing attacks was presented. A controlled laboratory experiment was conducted, with the results indicating the proposed approach as highly effective in protecting online services from phishing attacks. The results showed a 0% false-positive rate and 17.8% false-negative rate. Overall, the proposed solution provided a practical and effective way of preventing phishing attacks. [ABSTRACT FROM AUTHOR]

Cybersecurity is an ever-present problem for organizations, but organizational science has barely begun to enter the arena of cybersecurity research. As a result, the "human factor" in cybersecurity research is much less studied than its technological counterpart. The current manuscript serves as an introduction and invitation to cybersecurity research by organizational scientists. We define cybersecurity, provide definitions of key cybersecurity constructs relevant to employee behavior, illuminate the unique opportunities available to organizational scientists in the cybersecurity arena (e.g., publication venues that reach new audiences, novel sources of external funding), and provide overall conceptual frameworks of the antecedents of employees' cybersecurity behavior. In so doing, we emphasize both end-users of cybersecurity in organizations and employees focused specifically on cybersecurity work. We provide an expansive agenda for future organizational science research on cybersecurity—and we describe the benefits such research can provide not only to cybersecurity but also to basic research in organizational science itself. We end by providing a list of potential objections to the proposed research along with our responses to these objections. It is our hope that the current manuscript will catalyze research at the interface of organizational science and cybersecurity. [ABSTRACT FROM AUTHOR]

Copyright of Romanian Journal of Information Technology & Automatic Control / Revista Română de Informatică și Automatică is the property of National Institute for Research & Development in Informatics - ICI Bucharest and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Today, social engineering techniques are the most common way of committing cybercrimes through the intrusion and infection of computer systems. Cybersecurity experts use the term "social engineering" to highlight the "human factor" in digitized systems, as social engineering attacks aim at manipulating people to reveal sensitive information. In this paper, we explore how discursive framings of individual versus collective security by cybersecurity experts redefine roles and responsibilities at the digitalized workplace. We will first show how the rhetorical figure of the deficient user is constructed vis-à-vis notions of (in)security in social engineering discourses. Second, we will investigate the normative tensions that these practices create. To do so, we link work in science and technology studies on the politics of deficit construction to recent work in critical security studies on securitization and resilience. Empirically, our analysis builds on a multi-sited conference ethnography during three cybersecurity conferences as well as an extensive document analysis. Our findings suggest a redistribution of institutional responsibility to the individual user through three distinct social engineering story lines—"the oblivious employee," "speaking code and social," and "fixing human flaws." Finally, we propose to open up the discourse on social engineering and its inscribed politics of deficit construction and securitization and advocate for companies and policy makers to establish and foster a culture of collective cyber in/security and corporate responsibility. [ABSTRACT FROM AUTHOR]

Copyright of Military Engineer / Hadmérnök is the property of National University of Public Service and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Social engineering has posed a serious threat to cyberspace security. To protect against social engineering attacks, a fundamental work is to know what constitutes social engineering. This paper first develops a domain ontology of social engineering in cybersecurity and conducts ontology evaluation by its knowledge graph application. The domain ontology defines 11 concepts of core entities that significantly constitute or affect social engineering domain, together with 22 kinds of relations describing how these entities related to each other. It provides a formal and explicit knowledge schema to understand, analyze, reuse and share domain knowledge of social engineering. Furthermore, this paper builds a knowledge graph based on 15 social engineering attack incidents and scenarios. 7 knowledge graph application examples (in 6 analysis patterns) demonstrate that the ontology together with knowledge graph is useful to 1) understand and analyze social engineering attack scenario and incident, 2) find the top ranked social engineering threat elements (e.g. the most exploited human vulnerabilities and most used attack mediums), 3) find potential social engineering threats to victims, 4) find potential targets for social engineering attackers, 5) find potential attack paths from specific attacker to specific target, and 6) analyze the same origin attacks. [ABSTRACT FROM AUTHOR]

An increasing number of small and medium-sized enterprises (SMEs) use the Internet to support and grow businesses. The application of new technologies comes with inherent risks of ever-changing cyberspace and increasing cybercrime. Previous research has shown that the human factor remains the core element in the cybersecurity chain. Therefore, it is paramount that employees receive effective training to acquire a security mindset. This study puts forward previous research that resulted in a portable escape room game to raise cybersecurity awareness. The purpose of the study is to elaborate the transformation of the physical game into a virtual learning experience to increase flexibility in times such as the Covid-19 lockdown. As main method, we applied the design science framework of Hevner et al. As main result, the research elaborates the design of the developed artifact--a virtual prototype of the escape room game addressing the cybersecurity challenges of SMEs. For the evaluation of the prototype, empirical data was collected in qualitative and quantitative form. As main conclusions, we have observed that a physical escape room can be transformed into a virtual setting with little means without sacrificing player immersion. A limitation was identified in teaching targeted social engineering attacks. [ABSTRACT FROM AUTHOR]

The development of the digital economy is inextricably linked to cybersecurity. The article discusses issues related to the definition of cybersecurity, its elements, and examines data on cyber-attacks. The analysis of the tightness of the relationship between the share of the digital economy in GDP and the GCI index using a correlation analysis is carried out in this article. The issues of cybersecurity in the Republic of Moldova are also discussed and ways to improve it are suggested. Currently, there have been significant changes in the structure of cyber threats. These changes are associated with discrete changes in the motives and tactics of cybercriminals. The reasons for enrichment contributed to the emergence of crypto miners. At the same time, there is a shift towards reducing the use of malware and complex infrastructure and moving to low-profile social engineering attacks. This article analyzes the situation in the field of cybersecurity in the Republic of Moldova and provides suggestions for its improvement. [ABSTRACT FROM AUTHOR]