Cyber Warfare and Cyber Terrorism Threats Targeting Critical Infrastructure: A HCPS-based Threat Modelling Intelligence Framework

Abstract

Acts of cyber warfare and cyber terrorism (CWCT) that target a nation's critical infrastructure (CI) are quickly becoming a larger threat to national security than conventional kinetic warfare strategies. Adversaries or potential adversaries can target a nation's electrical grids, telecommunications, financial services, transportation, healthcare systems, and other forms of CI. These acts pose a major threat to a nation's CI and consequently exposes citizens to public health, safety, security, and economic development risks. Identifying cyber vulnerabilities and threats can help nations to improve their CI defence strategies. There is a crucial need for research that can aid in understanding the major types of CI threats and by what method they might occur. This paper conducts a systematic literature review to develop an initial threat intelligence framework of CWCT attacks on CI. Drawing from a Human–Cyber–Physical Systems (HCPS) lens, the threat intelligence framework classifies CWCT attacks according to the methods, weapons, vulnerabilities, targets and impact of the CWCT attack. The cyber warfare community can extend the proposed HCPS-based threat intelligence framework to develop more advanced cyber security mitigation strategies, training scenarios and simulations. Large-scale monitoring of CI threats requires in-depth threat intelligence analysis and a collaborative defence strategy. This calls for a higher degree of coordination and orchestration between the military, intelligence agencies, government departments, multinational allies, regulators, and commercial entities. Future research can customize the proposed HCPS-based threat intelligence framework to cater for the unique threats facing specific CI domains.

Infusing Morabaraba game design to develop a cybersecurity awareness game (CyberMoraba)

“…It aids in preventing data breaches, financial losses, and reputational damage, while also educating about personal privacy protection and secure online practices. Moreover, it ensures compliance with industry regulations, defends against social engineering tactics, and safeguards critical infrastructure from potential disruptions (Naidoo & Jacobs, 2023;Nkongolo & Tokmak, 2023). Embracing cybersecurity awareness reflects a global responsibility to maintain a secure digital landscape, fostering responsible online behavior and contributing to a safer internet for everyone.…”

“…Moreover, they contribute to creating a culture of cybersecurity, where knowledge is shared and best practices are followed, enhancing the collective resilience against cyberattacks. Ultimately, investing in cybersecurity awareness training results in a more vigilant, proactive, and security-conscious digital community (Chowdhury & Gkioulos, 2021;Naidoo & Jacobs, 2023). In this paper, we present "CyberMoraba," a game meticulously crafted to educate students about the nuances of cybersecurity awareness.…”

“…The target group for the CyberMoraba game is a critical aspect of its design and implementation. It is not a one-size-fits-all approach, as different groups within an organization may have varying levels of cybersecurity awareness and different roles and responsibilities in ensuring cybersecurity (Abd et al, 2015;Ortiz-Garces et al, 2023;Naidoo & Jacobs, 2023). For this study, the primary target audience is the students, and it is essential to customize the game's usage based on their specific needs.…”