bluuebunny/crossref_metadata_2025 huggingface dataset:
Disciplinary Variations in Framing Research Articles in the Social Sciences and Humanities
Authors: Yuvayapan Fatma , Yakut Ilyas
Published: June 2023

Metadiscourse is now a widely used term in academic discourse analysis. How academics employ rhetorical devices to structure their texts, establish reader-writer interaction and stamp their authorial stance regarding the conventions of the disciplines, cultures, and genres has been the subject of many studies. Despite the growing prominence of the term, however, some features of it, one of which is frame markers, have gone unnoticed. Frame markers signal the boundaries in the academic discourse for the readers' understanding, and they are a crucial rhetorical feature of metadiscourse. The present study examines the deployment of frame markers in research articles written between 2010 and 2019. Based on the analysis of frame markers in a corpus of research articles across four disciplines in social sciences, there were marked variations across the four disciplines in the use of frame markers and the occurrences of their sub-categories. The findings suggested that academic communities have a decisive role in constructing text structures in research articles. The results might offer guidance to academic writers on shaping the texts that their readers find persuasive.
Recherches récentes sur les ateliers de production et les amphores vinaires de Gaule Narbonnaise et de Tarraconaise. Introduction
Authors: Mauné Stéphane , Bigot Fabrice , Corbeel Séverine
Published: June 2023

Ce dossier rassemble une dizaine de contributions issue d’une table ronde tenue en 2016 à Aspiran (Hérault, France), dont l’objectif était de présenter les résultats de récents travaux concernant la problématique de la production d’amphores vinaires du Haut-Empire. Le territoire pris en compte couvre la Gaule Narbonnaise et la province hispanique de Tarraconaise. Cette introduction présente le cadre de la rencontre, un bref bilan historiographique de la recherche de ces dix dernières années puis résume les principaux acquis des différents articles qui forment ce dossier scientifique.
Un nouvel atelier d’amphores vinaires d’époque julio-claudienne dans la vallée de l’Arc à Favary (Rousset, B.-du-Rh.)
Authors: Bonaventure Bertrand , Mauné Stéphane , Corbeel Séverine
Published: June 2023

Cet article a pour objectif de présenter les résultats d’une fouille préventive réalisée en 2015 dans la haute vallée de l’Arc, en marge d’une villa d’époque romaine dont une grande partie de la pars fructuaria, à vocation vinicole, a été explorée. Un grand four à double couloir de chauffe très mal conservé, ainsi qu’un lot d’une quarantaine d’amphores apparemment produites sur place entre l’époque augustéenne et la fin des années 20 ap. J.-C., permettent d’évoquer la présence d’un atelier domanial. Après la présentation du contexte régional et des résultats de la fouille, une analyse chrono-typologique des fours augustéens provinciaux est proposée puis sont examinés les différents types d’amphore produits. Replacées dans le riche contexte archéologique de cette partie du territoire de la cité d’Aquae Sextiae, ces données illustrent une fois de plus l’importance du développement de la viticulture de rapport d’époque julio-claudienne en Narbonnaise orientale.
Bona Dea à Nîmes
Authors: Carrier Cécile
Published: June 2023

A residential and craft area of the roman period was found during the excavations of the Parking Jean-Jaurès in Nîmes (2006-2007, director Jean‑Y ves Breuil, INRAP). The new datas give a context to ancient discoveries like a female statue identified as Bona Dea. This statue could belong to a private worship, located in this area. A second statue found out the limits of the roman town could be attached to a public worship. These two statues and altars from Glanum, Arles and Apt are the only known references to the deity in Gallia Narbonensis. They are evidences of the modes of introduction and spreading of this worship came from Latium.
Guiding Local Tourism Entrepreneurs Interested in Ecotourism: A Tool for Extension Facilitators
Authors: Butler Megan , Gering Elizabeth , Wilsey David
Published: June 2023

Tourism can stimulate economies, promote cultural preservation, and incentivize environmental conservation. The tourism assessment and planning process described in this article is a tool for facilitating tourism development at the community level by helping entrepreneurs assess the products and services they currently offer, align their current tourism products with best practices for improving their businesses' sustainability, and coordinate efforts to harness the full benefits of sustainable nature-based tourism or ecotourism. Extension educators can use this tool to educate and coordinate tourism entrepreneurs and to encourage them to adopt practices that maximize the cultural, social, economic, and environmental benefits of local tourism by minimizing potential negative impacts.
Characteristics of Home Irrigation Users: Implications for Encouraging Landscape Water Conservation in the United States
Authors: Ali Amanda , Warner Laura
Published: June 2023

Home irrigation users are a relatively under-researched target audience for Extension, yet they are major consumers of water. To promote water conservation practices, Extension professionals need to understand key aspects of this group. For example, the home irrigation user participants in the study described here perceive water to be extremely important. They engage in water conservation by following water restrictions, are interested in irrigation technologies that save water, desire home and garden landscaping ideas, and prefer to get water conservation information from websites. However, their interaction with Extension is somewhat limited. To more effectively engage with this audience, Extension should provide relevant water conservation information on well-branded websites.
Using Standardized Evaluation Metrics to Demonstrate Collective Statewide Impacts of Diverse Water Conservation Programming
Authors: Chaudhary Anil , Warner Laura , Borisova Tatiana , Dukes Michael , Gonzalez Sebastian , Harder Amy , Wilber Wendy
Published: June 2023

Although the diversity of Florida Cooperative Extension landscape water conservation programs creates evaluation challenges, it is possible to measure their impacts as a whole. We conducted pilot testing of a statewide evaluation strategy and identified behavior changes resulting in an average monthly water savings of 3,257 gal and utility bill savings of $10.78 per participant. Here we explain the approach we used, providing details about underlying research on water conservation practices and technologies, standardized metrics for demonstrating environmental and economic impacts of behavior/technology adoption, and reporting tools. A focus on statewide impacts based on standardized metrics can be extremely valuable to U.S. Extension professionals.
The Farming Population and Health Insurance: Educational Needs and Approaches of Extension Professionals
Authors: Inwood Shoshanah , Portman Emily , Braun Bonnie , Loveridge Scott , Heiss Sarah , Knudson Alana
Published: June 2023

Health insurance policy has critical implications for farmers, who work in a dangerous occupation and have historically high rates of being uninsured and underinsured. Extension is well poised to respond to changing policies and provide outreach to agricultural communities. However, few studies have explored capacity within Extension to respond knowledgeably to health insurance–related opportunities. Accordingly, we conducted focus group sessions with Extension professionals to understand current efforts, resource needs, and opportunities for program development in this realm. Our findings revealed a need for knowledge building within Extension through programming collaboration and an opportunity to connect the agriculture and health insurance sectors. We also identified strategies for addressing the topic with farmers.
Emphasizing Extension's Unbiased, Research-Based Recommendations Is Critical
Authors: Monks Dale , Hagan Austin , Conner Kassie
Published: June 2023

With a multitude of information sources available to stakeholders, it is critical that Extension emphasize the supporting work and unbiased approach that comprise the backbone of our recommendations. In Alabama, management of target spot, a disease that can devastate cotton, is the result of 100 field trials, 6,700 man-hours, and $485,800 in grants. The team involved delivered 94 associated publications and stakeholder activities and posted information via YouTube and Twitter. For Cooperative Extension to remain relevant, we must emphasize our strong experiment station partnership that ensures a foundation firmly planted in unbiased, research-based information that is not influenced by outside, market-driven interests.
Reliability Analysis of the Adult Mentoring Assessment for Extension Professionals
Authors: Denny Marina
Published: June 2023

The Adult Mentoring Assessment for Extension Professionals will help mentors develop an accurate profile of their mentoring style with adult learners and identify areas of proficiency and deficiency based on six constructs—relationship, information, facilitation, confrontation, modeling, and vision. This article reports on the reliability of this new instrument. Extension agents in 10 southern states completed the assessment, and each construct was analyzed through the use of Cronbach's alpha procedures. All six constructs were well within the acceptable range of reliability. Personnel in other Extension systems and similar organizations can now be confident using this tool for training and development purposes.
New Extension Approaches to Serving Agricultural Media in Advancing Farm-Life Safety Communications
Authors: Heiberger Scott , Evans James
Published: June 2023

The study described here focused on needs and opportunities for Extension to serve agricultural media more fully in addressing new safety risks in agriculture, one of the nation's most hazardous industries. The study was conducted in the context of major broadening of channels used by agricultural media. A mixed-methods approach included a national survey to identify views and suggestions from agricultural journalists about covering farm-life safety. A companion literature review addressed case studies and other research featuring Extension collaborations with media for advancing farm-life safety. Findings revealed expanding opportunities and ideas for Extension personnel, with implications for Extension program areas beyond farm-life safety.
Preparing Future Professionals for Holistic Family and Consumer Sciences Programming
Authors: Franck Karen , Wise Dena , Penn Allisen , Berry Ann
Published: June 2023

It is critical that the value of Extension family and consumer sciences as a broadly focused profession be recognized both in and out of Extension. Establishing universally recognized competencies and assuring that agents possess those capabilities are vital steps to securing and maintaining the integrity of the profession and its value to those it serves. University of Tennessee Extension has developed a process for assessing basic competencies of newly hired agents and responding to their competency gaps with targeted training.
The Contribution of Urban 4-H to Social Capital and the Implications for Social Justice
Authors: Fields Nia
Published: June 2023

The idea that equal education exists in the United States is a misconception, and positive youth development programs are a proposed response to inequitable education. Youth development programs have the potential to increase one's social capital, particularly for youths who are marginalized by inequitable access to quality education. The study described here focused on the contribution of urban positive youth development to social capital and social justice. Findings indicate that 4-H initiatives related to social capital are reaching marginalized youths. However, barriers are preventing 4-H from reaching these youths adequately and/or consistently.
Establishing a Common Language: The Meaning of Research-Based and Evidence-Based Programming (in the Human Sciences)
Authors: Sellers Debra , Schainker Lisa , Lockhart Peggy , Yeh Hsiu
Published: June 2023

This article describes the development, implementation, and exploratory evaluation of a professional development series that addressed educators' knowledge and use of the terms research-based and evidence-based within Human Sciences Extension and Outreach at one university. Respondents to a follow-up survey were more likely to select correctly the commonly accepted standard for each term, and they reported asking more questions, talking with others, examining programs' evidence bases, and placing more value on fidelity and evaluation following participation in the professional development series. Educator reactions to the series were generally positive, although researchers interested in designing like programs might consider engaging educators within the context of their preexisting knowledge levels.
Processing Model and Classification of Cybercognitive Attacks: Based on Cognitive Psychology
Authors: Kim Ki Beom , Lim Eugene , Kwon Hun Yeong
Published: June 2023

Cybercognitive attacks, as witnessed in large and small wars and events along with the recent Russia-Ukraine war, are no longer traditional cyber operations, but are increasingly attacking the psychological weaknesses of targeted members of society and target organizations. Therefore, it is timely to systematically analyse and model cybercognitive attacks. Various definitions and case analyses of cybercognitive attacks are currently being actively conducted, but studies on clear classification and processing models of cybercognitive attacks are almost absent. Accordingly, this paper analyzed cases of cybercognitive attacks. The types derived through case analysis were divided into four categories, and cybercognitive attacks were classified and defined. On such basis, a processing model for cybercognitive attacks was designed, and furthermore, cybercognitive attack layers were classified and presented from the attacker and defender's perspective. The corresponding model and layer presented in this paper model both the countermeasures that can be used to perform cyber operations and the psychological mechanisms hidden in each response process. Specifically, a psychology-based cybercognitive attack processing model was designed to achieve goals by inducing behaviour from collecting information for system managers to inducing response/cognitive processing/decision making/compensation. As such, this paper focused on clarifying the definition of cybercognitive attacks and establishing performance procedures, which are only used as actions using deception by presenting cybercognitive attacks scientifically and logically using psychology descriptions. With that, this paper is expected to serve as the ground for cybercognitive kill chain research that can defend against further cyberattacks using cognitive vulnerabilities.
A Survey on National Cyber Emergency Plans
Authors: Adamos Konstantinos , Filippopoulos Ioannis , Stergiopoulos George , Gritzalis Dimitris
Published: June 2023

Operators of Essential services (OESs) and Critical infrastructures (CIs), whether private companies or public organizations are going through a digital transformation to pace with the evolution of technology and to bring better services to customers and countries’ citizens. Operational Technology (OT) systems like Supervisory Control and Data Acquisition (SCADA) and Distributed Control Systems (DCS) used to control and monitor functions in such infrastructures are converging with Information Technology (IT) environments. This convergence has exposed infrastructures to new cyber risks. For this reason, EU Member States have been trying to build resilience against cyber-attacks to ensure the stable operation of their states. Several countries have established cybersecurity incident response procedures as well as steps or phases of response before, during, and after a cyber incident. The sum of these procedures and guidelines constitutes their national cyber emergency plans (NCEPs). Still, these NCEPs differ widely in their approaches. These differences manifest as both managerial, governmental, legal, and technical, creating a complex environment worldwide. In this paper, we gather four major NCEPs worldwide to analyze and compare them with prominent standards and industry guidelines in cybersecurity, like the ISO 27001 and NIST 800 series. We investigate NCEP approaches to building cyber resilience based on their response models, their involved entities, the cooperation between agencies and other countries, and their risk-based categorization for cyber incidents. We elaborate on their differences, potential issues and divergences and argue whether these plans can be combined to bridge potential weaknesses. We selected and surveyed four (4) cyber emergency plans from four (4) countries that are frequent targets of cyber-attacks and have long experience in managing and responding to cyber incidents.
Assessment of Cyber Security risks: A Smart Terminal Process
Authors: Pöyhönen Jouni
Published: June 2023

In Finland, the connections to global maritime transportation logistics systems are an essential part of the national critical infrastructure. As a part of maritime logistics systems, the port's operations are important elements for global maritime traffic and the transportation supply chain. Digitalization of seaport services makes it possible to increase the efficiency of terminal systems in the logistic processes. At the same time, port logistic processes can notably reduce its CO2 emissions by optimizing port operations. The improvement of port processes relies very much on the development of Information and Communication Technology (ICT) and Industrial Control Systems (ICS) or Operation Technologies (OT) systems. In port environment there are parts that are controlled (ICS/OT) from the cyber environment but directly interact with the physical surroundings. These are called Cyber-Physical Systems (CPS). In this environment, the cyber security aspects of the port logistic need to be addressed. In Finland, the Port SMARTER research program has been on the way since 2021. The aim of the program is to create port services within new technology solutions, and that way improve cargo and people flows while improving the experience for all stakeholders. However, this development increase also complicated system dimensions in the use of ports and makes port operations complex systems of systems environment characterized by a conglomeration of interconnected networks and dependencies. This paper describes a practical approach to risk assessment work regarding the SMARTER research case. It provides a comprehensive cyber security investigation approach to port operations at the system level. In risk assessment work, the paper emphasizes the importation of description of probabilities to defend the system element against estimated probabilities of cyber-attacks at all parts of port processes. The findings of the study are related to the comprehensive cyber security architecture of the SMARTER research goals. The following research interests are related to the issue: "How a comprehensive cyber security investigation can be conducted in smart ports operations?” This paper emphasizes cyber security risks assessment work should be covered from services for operation, information flows in and between systems, as well as electricity supplies to achieve holistic risks assessment in the smart terminal process.
Smart Terminal System of Systems’ Cyber Threat Impact Evaluation
Authors: Simola Jussi , Pöyhönen Jouni , Lehto Martti
Published: June 2023

Systems of system-level thinking is required when the purpose is to develop a coherent understanding of the ecosystem where every user and system requirements are divided into specific parts. The smarter project, as a part of the Sea4value program of DIMECC, aims to develop harbor operations, including passenger and cargo transportation, in a way that port processes will improve, emissions will decrease, and overall security will enhance in smart ports. This paper describes cyber-attack impacts against the Smart terminal system of systems in the cyber realm by utilizing the MITRE ATTACK® framework to map the objectives of threat actors. The Smart Terminal system environment includes ICT, ICS networks and components, communication systems, and port service systems. Internal and external threat sources or actors are hard to divide exactly because of the diversity of the threats. Hybrid threats challenge maritime domain awareness globally. The cyber threat impacts on IT and OT environments are connected to each other because of the use of internal and external networks that impact each other by combining vulnerabilities and threats. Well-working port and terminal operations require not only protected operational systems or sensor systems, but human errors must also be minimized. Objectives of threat actors are presented, categorized, and listed. Threat scenarios illustrate that cyber threats and risks are mainly similar in the maritime global-linked port community and basic hinterland trade. The networked supply chain of the business causes evolving and combined threat scenarios. European and international standards, regulations, policies, recommendations, and, e.g., guidelines by the IMO, set new cyber-threat requirements for port and terminal services and facilities. Therefore, overall security must be considered when cyber-security is the development area. Information exchange in an understandable form is essential for maintaining business continuity. Threat information has to be transferred among stakeholders as well as cyber security codes have to be followed in the port operations of partners that are involved, for example, in operational and system-level actions. Digitalization in smart ports and terminals enhances the capacity to handle cargo and passengers more efficiently, but cyber threats evolve.
Design Lessons from Building Deep Learning Disinformation Generation and Detection Solutions
Authors: Maathuis Clara , Kerkhof Iddo , Godschalk Rik , Passier Harrie
Published: June 2023

In its essence, social media is on its way of representing the superposition of all digital representations of human concepts, ideas, believes, attitudes, and experiences. In this realm, the information is not only shared, but also {mis, dis}interpreted either unintentionally or intentionally guided by (some kind of) awareness, uncertainty, or offensive purposes. This can produce implications and consequences such as societal and political polarization, and influence or alter human behaviour and beliefs. To tackle these issues corresponding to social media manipulation mechanisms like disinformation and misinformation, a diverse palette of efforts represented by governmental and social media platforms strategies, policies, and methods plus academic and independent studies and solutions are proposed. However, such solutions are based on a technical standpoint mainly on gaming or AI-based techniques and technologies, but often only consider the defender’s perspective and address in a limited way the social perspective of this phenomenon becoming single angled. To address these issues, this research combines the defenders’ perspective with the one of the offenders by (i) building a hybrid deep learning disinformation generation and detection model and (ii) capturing and proposing a set of design recommendations that could be considered when establishing patterns, requirements, and features for building future gaming and AI-based solutions for combating social media manipulation mechanisms. This is done using the Design Science Research methodology in Data Science approach aiming at enhancing security awareness and resilience against social media manipulation.
Tackling Uncertainty Through Probabilistic Modelling of Proportionality in Military Operations
Authors: Maathuis Clara , Chockalingam Sabarathinam
Published: June 2023

Just as every neuron in a biological neural network is a reinforcement learning agent, thus a component of a large and advanced structure is de facto a model, the two main components forming the principle of proportionality in military operations can be seen and are as a matter of fact two different entities and models. These are collateral damage depicting the unintentional effects affecting civilians and civilian objects, and military advantage symbolizing the intentional effects contributing to achieving the military objectives defined for military operation conducted. These two entities are complex processes relying on available information, projection on time to the moment of target engagement through estimation and are strongly dependent of common-sense reasoning and decision making. As a deduction, these two components and the proportionality decision result are processes surrounded by various sources and types of uncertainty. However, the existing academic and practitioner efforts in understanding the meaning, dimensions, and implications of the proportionality principle are considering military-legal and ethical lenses, and less technical ones. Accordingly, this research calls for a movement from the existing vision of interpreting proportionality in a possibilistic way to a probabilistic way. Henceforth, this research aims to build two probabilistic Machine Learning models based on Bayesian Belief Networks for assessing proportionality in military operations. The first model embeds a binary classification approach assessing if the engagement is proportional or disproportional, and the second model that extends this perspective based on previous research to perform multi-class classification for assessing degrees of proportionality. To accomplish this objective, this research follows the Design Science Research methodology and conducts an extensive literature for building and demonstrating the model proposed. Finally, this research intends to contribute to designing and developing explainable and responsible intelligent solutions that support human-based military targeting decision-making processes involved when building and conducting military operations.
Spreading Lies Through the Cyber Domain
Authors: Dempsey Thomas
Published: June 2023

The expansion of Information Operations (IO) over the past ten years has allowed individuals and groups to increase their sphere of influence on a global scale. Nation-state cyber threat actors have increased their presence on social media, building out false personas to influence large populations. This type of activity is difficult to stop due to the availability of social networks on the internet and the ease of creating false personas that can’t be directly attributed to the actor. IO activity has been observed with the Russian cyber activity during the 2016 U.S. Presidential elections and from Russian social media campaigns provoking extremist groups and attempting to cause physical harm, such as the 2017 campaign on Facebook to start a rally and a simultaneous counter rally in front of the Islamic Da’wah Centre of Houston. Although Russia has been observed leveraging this capability, they are not the only global actor in the cyber domain taking advantage of IO. Global threat actors have leveraged social media platforms and blogs to influence the global population and spread propaganda. This type of activity has been seen within traditional warfare using propaganda techniques. With the introduction of the cyber domain into warfare, there is an increased ability to communicate not only to one population but to the global community with the intent to manipulate the masses using IO. This paper examines the Cybersecurity Operations (CO) that have been observed utilizing IO and the psychological impacts they have had in successful campaigns against the United States. This paper argues that with increased influence capabilities in the cyber domain, individuals and groups will continue using IO to support tactical and strategic objectives. Through the available literature, this paper examines the impacts that IO has had on the United States through attempts to manipulate elections and create divides in the nation over the last ten years. This paper leverages the psychology of group processes to analyze the literature involving social media campaigns and the influencing of groups through the lens of social identity theory to provide new insight into mitigating and countering IO.
Detect, Deny, Degrade, Disrupt, Destroy, Deceive: which is the greatest in OCO?
Authors: Grant Tim
Published: June 2023

In the cyber kill chain literature, possible courses of action are listed as detect, deny, degrade, disrupt, destroy, and deceive (a.k.a. “the 6Ds”). These verbs denote defensive action to be taken against an intruder. By comparison, military doctrine for cyberspace operations encompasses cyberspace exploitation and attack, as well as defence. The question arises whether the 6Ds are also applicable to offensive action, i.e. exploitation and attack, or whether additional action verbs are needed. Military doctrine is evolving towards all-domain operations, in which action in cyberspace is integrated with action in the physical domains of land, sea, air, and space. This prompts the question as to whether the 6Ds are also suited to action in a physical domain. A pilot study of actual military operations that integrated cyber and physical action suggests that deception, delay, and denial of organisational and cyber entities is suited to cyber action, while seizure, capture, and destruction of physical entities is suited to physical action. Preference among action verbs may indicate when it is best to engage targets using cyber or physical resources and which action is preferred. This paper identifies which action verbs are best suited to offensive cyber operations in the context of all-domain operations. The paper reviews related theory on cyberspace and the cyber kill chain. It identifies action verbs in US Department of Defense (DoD) doctrine on information and cyberspace operations, comparing them to those in the US DoD Dictionary of Military and Associated Terms. After discussing the findings, the paper draws conclusions and recommends further work.
Legal Response to Social Media Disinformation on National Level
Authors: Watney Murdoch
Published: June 2023

Social media has an enormous impact on the manner in which society communicates and shares information. Digital is no longer a supplementary channel, but is the first place most people go to for news, information and communication. The transmission of social media disinformation has increased dramatically across the world and it necessitates a response. The discussion focuses on the response to social media disinformation on a national level. The discussion does not focus on foreign state or state-sponsored actors of misinformation. The focus and publicity may - within the context of cybersecurity - predominantly have been on cyberattacks, such as ransomware attacks. However, recent incidents - unrelated to foreign state interference and cyberattacks - illustrate that cybersecurity law must encompass the threat of disinformation. The 2020 COVID-19 pandemic, 2021 Washington, DC, United States, and South African as well as the 2023 Brazil riots illustrate the harmfulness of social media disinformation. Cognisance should be taken of the lessons learnt from the examples of social media disinformation as it may assist in determining a response to disinformation. There are various responses to national social media disinformation, such as legislative social media platform regulation, censorship, and criminalisation of the disinformation by itself. The response within the context of a cybersecurity threat landscape necessitates scrutiny as the response may impact on human rights. The trade-off between security and human right protection may be the violation of human rights to prevent harm from disinformation.
Organisational GDPR Investments and Impacts
Authors: Hirvonen Pauliina
Published: June 2023

The aim of this empirical multi-case study is to understand the GDPR investments and impacts of the organisations. Among these, the measuring experiences related to GDPR and information security (Isec), and the future expectations are examined. Several interesting findings were recognised, which also enabled further suggestions. First, an understanding of the organisations’ investments and their impact is built by gathering information about the actions that organisations made to fulfil the GDPR requirements. In the second phase, it is deemed necessary to examine how organisations experience the measures and evaluation of GDPR development and progress, in order to understand how respondents, end up evaluating the impact of their investments. In the third phase it is considered necessary to consider the future development of GDPR and the challenges and opportunities it brings to organisations, in order to understand how the experiences so far affect preparations for the future. The final phase of evaluation focuses on finding out what impact the GDPR has had on organisations. On the one hand, it is possible that the total investment in the GDPR may also correlate with the development of the organisational Isec maturity, because GDPR has brought more resources and visibility to the organisation’s Isec, and operations have become more systematic. On the other hand, organisations with an already high level of Isec maturity and organisations operating in a regulatory-focused industry may accept the GDPR-based Isec investments more easily. If GDPR is tightly integrated with both the organisation’s information security and the business functions under the responsibility of executive management, it may support the organisation’s business and information security development. This research serves GDPR authorities, organisational executives, persons in charge of GDPR/information security/cybersecurity, service providers and academia.
The Identification of Cybersecurity Work Roles for the Water Sector in South Africa
Authors: Von Solms Sune
Published: June 2023

This paper presents the results of a content analysis conducted on the work roles of cybersecurity practitioners for the water sector of South Africa. The paper presents literature review findings on national and international frameworks and guidelines detailing cyber security considerations for the South African water sector as well as national and international guidelines and frameworks which detail the various work roles carried out by cybersecurity practitioners in an organisation. The study found that cyber security considerations and work roles such as physical security of assets, testing and assessment of cybersecurity methods, supply chains cyber security as well as incident investigation and interfacing with law enforcement, were not well defined for cyber security discipline. The study delivers a framework detailing the work roles of cybersecurity practitioners which can be applied to the South African water sector.
Towards Norms for State Responsibilities regarding Online Disinformation and Influence Operations
Authors: Van Niekerk Brett , Ramluckan Trishana
Published: June 2023

The Internet has provided a global mass communication system, and in particular social media technologies began a social revolution for the public sphere. However, these platforms have been exploited for the purposes of influence operations and disinformation campaigns to hinder or subvert national decision-making processes by affecting the policy makers, voters, or swaying general public opinion. Often this is achieved through manipulative means falling within a grey area of international and constitutional systems. Existing proposed normative frameworks for responsible state behaviour in Cyberspace have tended to focus on cyber operations. While online influence operations are recognised as a concern, they were not explicitly discussed in the frameworks, resulting in knowledge gaps related to countering influence operations and disinformation. There is a growing narrative that influence operations and disinformation campaigns are a cyber security issue and nations sometimes include legislation related to disinformation in cyber security. This indicates that existing cyber norms can be used to guide the development of norms for addressing disinformation and influence operations. This paper aims to propose a normative framework for state responsibility relating to influence operations emerging from thematic analysis of existing cyber norms and research on mitigating influence operations.
Students’ Application of the MITRE ATT&CK® Framework via a real-time Cybersecurity Exercise
Authors: Rege Aunshul , Williams Jamie , Bleiman Rachel , Williams Katorah
Published: June 2023

The MITRE ATT&CK framework enables practitioners to understand and track cyber adversary behaviors. Concepts such as social engineering (SE) are not directly captured in current version of ATT&CK as an individual technique, though the application of SE is relevant to many technical behaviors. Utilizing the ATT&CK framework in an educational setting, specifically within a competition focused on SE, allows students to explore adversarial behavior through experiential learning and understand how SE is relevant within cybersecurity. The structure of the framework allows students to see and describe each behavior from the perspective of the adversary, motivating them to compile and question “why” and “how” each individual action contributes to the operational objectives. This paper shares students’ mappings of the ATT&CK framework to playbooks they developed during a real-time SE penetration testing competition. Students were given numerous flags to pursue during the competition and this paper will share their playbooks and mappings to the ATT&CK framework. This paper demonstrates that while someone with more knowledge and experience using the framework may map a SE case study differently than multidisciplinary students who are experiencing it for the first time, there is not a single correct way to map onto the matrix. Having students experience this mapping process allows them to understand the breakdown of an adversary’s behavior and interpret key tactics and techniques in a way that fits their mapping needs. This paper also demonstrates how a SE case study can be mapped onto the ATT&CK framework despite SE not being the focus of the framework, and that SE uses tactics and techniques that are also relevant to technical cyberattacks. The authors hope to encourage more interdisciplinary cybersecurity education by sharing this experiential learning event.
On Benchmarking and Validation in Wargames
Authors: Wilden Adam , Nasim Mehwish , Williams Peter , Legrand Tim , Turnbull Benjamin , Williams Patricia
Published: June 2023

There are multiple arguments for and against wargames. Many scientists do not recognise the science in wargames. It is suggested that there is not enough literature relating to wargaming, for there to be any large-scale research into wargames. This is primarily because scientists often refuse to publish results, thus creating a vicious cycle where research is not published because there is not enough research being published. This ultimately deters researchers from studying wargaming in any serious fashion. Owing to this limitation, published work on the results, and protocols of wargames are scarce in scholarly research. Wargaming has considerably less academic focus with a fragmented and practical focus on design and benchmarking. This is surprising given the long history of wargaming (dating back to the early 1600’s), when compared to the relatively recent history of other domains such as software engineering. To better understand the current state of research into wargaming in reference to benchmarking and validation, a scoping review (SR) was conducted. The scholarly research into wargaming reveals papers on general modelling, conflict modelling, influence modelling, evaluation of wargames, analytical tools, use of AI in wargame design, evaluation of predictive modelling in wargames, improving command and control through wargaming, and cost-benefit analysis for decision making. The initial analysis of the coverage of wargaming research, together with the limited number of papers found, indicate that there is a distinct lack of academic research into wargaming. Additionally, there is a wide variety of areas that are interested in the wargaming field, however, with no universal method of analysis or benchmarking, this limits the reproducibility of results, and the ability to judge the overall effectiveness of wargaming efforts. Wargame designers need to be able to assess wargame components to validate, compare, and predict the effects on gameplay and for decision-makers to draw conclusions with more confidence.
Enabling fine-grained access control in information sharing with structured data formats
Authors: Niskanen Tatu , Salonen Jarno
Published: June 2023

The ongoing need for societal and industrial digital transformation requires rapidly expanding networks of interconnected organizations and dictates an increasing role for cybersecurity in information sharing. A typical setup consists of multiple stakeholders working closely together and needing efficient channels for sharing relevant information in a secure manner. This is especially prevalent with complex modern supply chains and critical information infrastructures. They often comprise of numerous co-operating organizations, people and in some cases smart devices having different levels of access to a variety of information. Granular access control plays a vital role when distributing information efficiently between stakeholders without revealing sensitive pieces of data to unwanted third parties. This article presents a novel framework for enabling fine-grained access control to share information efficiently and securely in these situations. Our motivation and use case for the framework originates from the secure sharing of cyber incident information in the maritime logistics industry. We present a novel solution to this problem by developing an information sharing platform and a meta-model, demonstrated using an implementation with structured JSON data formats, while supporting previously researched attribute-based encryption schemes. The proposed framework provides a broader context to the fine-grained data access control challenge in addition to the technical implementation.
DPIA for Cloud-based Health Organizations in the context of GDPR
Authors: Georgiou Dimitra , Lambrinoudakis Costas
Published: June 2023

The General Data Protection Regulation is the core instrument of the reformed legal framework for personal data protection in the European Union. The GDPR was put into effect on May 25, 2018, and requires assessing and conducting a Data Protection Impact Assessment for processing operations that are likely to result in a high risk to the rights and freedoms of natural persons, specifically using new technologies and considering the nature, scope, context, and purposes of the processing. Although GDPR does not precisely specify the types of processing activities for which a DPIA would be necessary, through the guidelines that it provides, the organization should conduct a DPIA, if there is large scale processing of health data. An example of this, is a Cloud-based Health Organization. Taking into account this parameter, that Cloud-based Health Organization processes personal data that could impact the freedoms and rights of a data subject under the GDPR and that the GDPR does not specify a DPIA process to follow, instead it allows organizations to use a framework that complements their existing processes, this paper presents the last two steps of a DPIA study for a Cloud-based Health Organization and provides guidelines on how to carry them out effectively. This study is part of a project for the compliance of Cloud-based Health Organizations with the General Data Protection Regulation 2016/679. For fulfilling the objectives of this study, the PIA-CNIL methodology is applied, which is in accordance with the data privacy impact assessment that has been described in ISO/IEC 29134. The main contribution of this work is the development of a guide that is designed to help Cloud-based Health organizations identify, analyze and reduce data protection risks in relation to their processing activities. More analytically, this research presents the risks that could be materialized by the data processing activities carried out by a Cloud-based Health Organization regarding its Processing Activities and could have an impact on the fundamental rights and freedoms of natural persons.
Static Vulnerability Analysis Using Intermediate Representations: A Literature Review
Authors: Spanier Adam , Mahoney William
Published: June 2023

Analysis (SA) in Cybersecurity is a practice aimed at detecting vulnerabilities within the source code of a program. Modern SA applications, though highly sophisticated, lack programming language agnostic generalization, instead requiring codebase specific implementations for each programming language. The manner in which SA is implemented today, though functional, requires significant man hours to develop and maintain, higher costs due to custom applications for each language, and creates inconsistencies in implementation from SA-tool to SA-tool. A source of programming language generalization occurs within compilers. During the compilation process, source code is converted into a grammatically consistent Intermediate Representation (IR) (e.g. LLVM-IR) before being converted to an output format. The grammatical consistencies provided by the IR theoretically allow the same program written in different languages to be analyzed using the same mechanism. By using the IRs of compiled programming languages as the codebase of SA practices, multiple programming languages can be encompassed by a single SA tool. To begin understanding the possibilities the combination of SA and IRs may reveal, this research presents the following outcomes: 1) a systematic literature search, 2) a literature review, and 3) the classification of existing work pertaining to SA practices using IRs. The results of the study indicate that generalized Static Analysis using the LLVM IR is already a common practice in all compilers, but that the extended use of the LLVM IR in Cybersecurity SA practices aimed at finding vulnerabilities in source code remains underdeveloped.
Governance and management information system for cybersecurity centres and competence hubs
Authors: Rajamäki Jyri , Lahdenperä Janne
Published: June 2023

Information sharing allows organizations to leverage the collective knowledge, experience, and analytical capabilities of their sharing partners in a community of interest. Sharing information is made easier with the help of a suitable information system. The DYNAMO project (10/2022-9/2025) creates tools for the cyber situational picture to support decision-making. One task of its mode of operation is to continue the development of the assets designed in the ECHO project (2/2019-2/2023). This article examines the design of ECHO's governance and management information system and how it can be applied to support the organisational processes and information-sharing needs of the collaborative network as a part of the DYNAMO project.