第14章サイバー資源の品質とサイバーコンピューティングのガバナンス

By the end of this section, you will be able to:

• Understand the meaning of cybersecurity

• Learn how to secure information and communication

• Learn how cybersecurity can be used to protect software solutions

• Learn how cybersecurity can be used to protect Internet mobile/web applications

• Understand how cybersecurity can be used to protect cloud-centric solutions

• Relate to cybersecurity as it applies to Industry 4.0 metaverse smart ecosystems

• Relate to cybersecurity as it applies to Industry 5.0 supersociety solutions

As discussed in the previous section, broadscale adoption of cyber resources brings challenges as it seeks to ensure TRM qualities such as security, performance, and reliability. This section focuses on enforcing cybersecurity assurance, which is the confidence that every effort is made to protect IT solutions against undesirable use. Cybersecurity assurance is an in-depth topic, and due to lack of space, this section will provide only a brief overview.

The field of cybersecurity includes the policies, procedures, technology, and other tools, including people on which organizations rely to protect their computer systems and information systems environments from digital threats. Cybersecurity focuses on five categories of security: network, application, critical infrastructure, IoT, and cloud. To assess an organization’s cyber risks and develop cybersecurity assurance, you should ask the following questions:

• What is the threat model?

• Who are the attackers, and what are their capabilities, motivations, and access?

• What are the risks, vulnerabilities, and likeliness of breach per risk assessment?

• What are the technical and nontechnical countermeasures, and how much will the countermeasures cost, including both direct and indirect costs? (Nontechnical countermeasures include laws, policies, procedures, training, auditing, and incentives. Indirect costs can be reputation, or future business.)

• What assets do you seek to protect? (This question relates to security policies that address confidentiality, integrity, service availability, privacy, and authenticity.)

• Who and what do you trust to help maintain cybersecurity?

Cybersecurity threats include behaviors such as

• breaching privacy by revealing confidential information such as corporate secrets, private data, or personally identifiable information (PII);

• damaging integrity/authenticity by destroying records, altering data, or installing unwanted software (e.g., spambot, spyware); and

• denying access to a service through activities such as crashing a website for political reasons, causing a denial-of-service attack, or allowing only certain individuals to have access to services.

In 2001, the Open Web Application Security Project (OWASP) was launched with the purpose of securing web applications. This model was only concerned with actionable controls and possible risks. The controls were focused on securing the risks involved with the development and deployment of the applications (Table 14.3).

To achieve security, we must eliminate defects and design flaws in systems and make them harder for hackers to exploit. This includes developing a foundation for deeply understanding the networked information systems we use and build. We also must be aware that no system is completely secure. To learn more, read this article about the security mindset (https://openstax.org/r/76security) from the Journal of Cybersecurity.

In 2023, the average cost of a data breach was $4.45 million globally, which, in just three years, was a 15% increase over 2020.¹² These costs cover expenses incurred to discover and respond to breaches, lost revenue from downtime, and long-term damages to the business reputation and brand. Cybersecurity Ventures recently shared its top ten cybersecurity predictions and statistics for 2024, unveiling the alarming fact that global cybercrime financial damage will likely reach $10.5 trillion by 2025. Based on this total, if cybersecurity is regarded as a country, it would rank third, trailing only the United States and China as the world’s largest economy.¹³ Personally identifiable information (PII) is generally the target of cybercriminals. They collect information, such as names, addresses, identification numbers, and credit card information, and sell them in the dark web or other underground marketplaces. This results in several consequences for these organizations, including regulatory fines, legal action, and the loss of customer trust.

Cybersecurity is increasingly important as the cost of breaches increases. However, a comprehensive cybersecurity strategy based on best practices and using machine learning, advanced analytics, and artificial intelligence (AI) can effectively combat cyber threats and reduce the impacts of breaches.