Practitioners’ Views on Cybersecurity Control Adoption and Effectiveness

Abstract

Cybersecurity practitioners working in organisations implement risk controls aiming to improve the security of their systems. Determining prioritisation of the deployment of controls and understanding their likely impact on overall cybersecurity posture is challenging, yet without this understanding there is a risk of implementing inefficient or even harmful security practices. There is a critical need to comprehend the value of controls in reducing cyberrisk exposure in various organisational contexts, and the factors affecting their usage. Such information is important for research into cybersecurity risk and defences, for supporting cybersecurity decisions within organisations, and for external parties guiding cybersecurity practice such as standards bodies and cyber-insurance companies.Cybersecurity practitioners possess a wealth of field knowledge in this area, yet there has been little academic work collecting and synthesising their views. In an attempt to highlights trends and a range of wider organisational factors that impact on a control's effectiveness and deployment, we conduct a set of interviews exploring practitioners' perceptions. We compare alignment with the recommendations of security standards and requirements of cyberinsurance policies to validate findings. Although still exploratory, we believe this methodology would help in identifying points of improvement in cybersecurity investment, describing specific potential benefits. CCS CONCEPTS• Security and privacy → Systems security; Network security; Human and societal aspects of security and privacy.

Boosting Holistic Cybersecurity Awareness with Outsourced Wide-Scope CyberSOC: A Generalization from a Spanish Public Organization Study

“…Holistic cybersecurity foundations and cybersecurity context in public sector [2,3,13,[15][16][17][18][19][20][21][22][23][24][25][26][27][28][29][30][31][32][33][34] Tactical-operational cybersecurity workforce management [1,[35][36][37][38][39][40][41][42][43][44][45][46][47] Cybersecurity talent development and retention [4][5][6][7][8][9][10][48][49][50][51][52][53][54]…”

“…However, none of them are comprehensive models that can be used within an organization to handle cybersecurity at tactical and operational levels with a managerial approach. From our perspective, holism can only be achieved by designing and applying managerial techniques not only to lower levels, but also from lower levels, from those who must cooperate in the short and medium term to execute and design cybersecurity safeguards in the last mile, as considered by Axon et al in [39].…”

CyberTOMP: A Novel Systematic Framework to Manage Asset-Focused Cybersecurity From Tactical and Operational Levels

“…What has not been measured cannot be improved. This statement, extrapolated to cybersecurity, implies the need to evaluate the effectiveness of cybersecurity controls [64] and safeguards, from a holistic and multidisciplinary perspective, and offer a shared vision of the organization's cybersecurity posture.…”

Fast, Lightweight, and Efficient Cybersecurity Optimization for Tactical–Operational Management

“…Another challenge lies in achieving holism [7] when collaborating in cross-functional internal-external teams with different chains of command at lower organizational levels, which necessitates the development of suitable mechanisms. Additionally, the absence of standardized and homogeneous cybersecurity evaluation criteria [8] at lower levels poses a significant challenge to assessing the current and expected cybersecurity status in a holistic manner.…”