Security: Theory and Practice

Aghazadeh Ardebili, A., Lezzi, M., Pourmadadkar, M. (2024). Risk assessment for cyber resilience of critical infrastructures: methods, governance, and standards. Applied Sciences, 14(24), 11807, https://doi.org/10.3390/app142411807 DOI: https://doi.org/10.3390/app142411807
Google Scholar

Ahmedi Mehri, V., Arlos, P., Casalicchio, E. (2022). Automated context-aware vulnerability risk management for patch prioritization. Electronics, 11(21), 3580, https://doi.org/10.3390/electronics11213580 DOI: https://doi.org/10.3390/electronics11213580
Google Scholar

Alluqmani, K., Karrar, A.E., Alhaidari, M., Alharbi, R., Alharbi, S. (2025). Assessing the efficacy of security awareness training in mitigating phishing attacks: a review. International Journal of Advanced Trends in Computer Science and Engineering, 14(3), 177–184, https://doi.org/10.30534/ijatcse/2025/141432025 DOI: https://doi.org/10.30534/ijatcse/2025/081432025
Google Scholar

Alqahtani, N., Almukaynizi, M. (2026). VulnScore: a deployed system for patch prioritization combining human input and temporal threat intelligence. International Journal of Information Security, 25, art. 2, https://doi.org/10.1007/s10207-025-01164-3 DOI: https://doi.org/10.1007/s10207-025-01164-3
Google Scholar

Axelos (2019). ITIL Foundation: ITIL 4 Edition. TSO (The Stationery Office).
Google Scholar

Bennouk, K., Ait Aali, N., El Bouzekri El Idrissi, Y., Sebai, B., Faroukhi, A.Z., Mahouachi, D. (2024). A comprehensive review and assessment of cybersecurity vulnerability detection methodologies. Journal of Cybersecurity and Privacy, 4(4), 853–908. https://doi.org/10.3390/jcp4040040 DOI: https://doi.org/10.3390/jcp4040040
Google Scholar

Bhargava, P., Choudhary, R., Gupta, A. (2022). A review study on computer virus. World Journal of Research and Review, 14(5), 39–44.
Google Scholar

Binnar, P., Bhirud, S., Kazi, F. (2024). Security analysis of cyber physical system using digital forensic incident response. Cyber Security and Applications, 2, art. 100034. https://doi.org/10.1016/j.csa.2023.100034 DOI: https://doi.org/10.1016/j.csa.2023.100034
Google Scholar

Chamkar, S.A., Maleh, Y., Gherabi, N. (2024). Security operations centers: use case best practices, coverage, and gap analysis based on MITRE adversarial tactics, techniques, and common knowledge. Journal of Cybersecurity and Privacy, 4(4), 777–793. https://doi.org/10.3390/jcp4040036 DOI: https://doi.org/10.3390/jcp4040036
Google Scholar

Cornish, P. (Ed.) (2021). The Oxford Handbook of Cyber Security. Oxford University Press. https://doi.org/10.1093/oxfordhb/9780198800682.001.0001 DOI: https://doi.org/10.1093/oxfordhb/9780198800682.001.0001
Google Scholar

Cost of a Data Breach Report 2025. IBM. https://www.ibm.com/reports/data-breach [accessed: 18.01.2026].
Google Scholar

Craigen, D., Diakun-Thibault, N., Purse, R. (2014). Defining cybersecurity. Technology Innovation Management Review, 4(10), 13–21. https://doi.org/10.22215/timreview/835 DOI: https://doi.org/10.22215/timreview/835
Google Scholar

Culot, G., Nassimbeni, G., Podrecca, M., Sartor, M. (2021). The ISO/IEC 27001 information security management standard: literature review and theory-based research agenda. The TQM Journal, 33(7), 76–105. https://doi.org/10.1108/TQM-09-2020-0202 DOI: https://doi.org/10.1108/TQM-09-2020-0202
Google Scholar

Cyberthreat Defense Report 2024. CyberEdge Group. https://cyberedgegroup.com/wp-content/uploads/2024/05/CyberEdge-2024-CDR-Report-v1.0.pdf [accessed: 18.01.2026].
Google Scholar

Dawkins, J. (2025). What’s in a Name? The Origin of Cyber. The CISO Inc. https://www.ciso.inc/blog-posts/origin-cyber/ [accessed: 18.01.2026].
Google Scholar

Downe, L. (2022). Good Services: How to Design Services That Work. BIS Publishers.
Google Scholar

Dykstra, J., Gordon, L.A., Loeb, M.P., Zhou, L. (2023). Maximizing the benefits from sharing cyber threat intelligence by government agencies and departments. Journal of Cybersecurity, 9(1), tyad003. https://doi.org/10.1093/cybsec/tyad003 DOI: https://doi.org/10.1093/cybsec/tyad003
Google Scholar

Egbuagha, O., Ikwunna, E. (2025). Post-quantum cryptography in practice: a literature review of protocol-level transitions and readiness. Cryptology ePrint Archive, 048. https://eprint.iacr.org/2025/048 [accessed: 18.01.2026].
Google Scholar

Feng, Z., Li, Z., Cui, H., Whitty, M.T. (2025). Identity management systems: a comprehensive review. Information, 16(9), 778. https://doi.org/10.3390/info16090778 DOI: https://doi.org/10.3390/info16090778
Google Scholar

François, M., Arduin, P.E., Merad, M. (2023). Classification of decision support systems for cybersecurity. In 15th Mediterranean Conference on Information Systems (MCIS) and the 6th Middle East & North Africa Conference on Digital Information Systems (MENACIS). https://aisel.aisnet.org/mcis2023/12
Google Scholar

Global Cybersecurity Outlook 2025. Insight report (2025). World Economic Forum. https://reports.weforum.org/docs/WEF_Global_Cybersecurity_Outlook_2025.pdf [accessed: 18.01.2026].
Google Scholar

Glöckler, J., Sedlmeir, J., Frank, M., Fridgen, G. (2024). A systematic review of identity and access management requirements in enterprises and potential contributions of self-sovereign identity. Business & Information Systems Engineering, 66(4), 421–440. https://doi.org/10.1007/s12599-023-00830-x DOI: https://doi.org/10.1007/s12599-023-00830-x
Google Scholar

Henrico, S., Putter, D. (2025). Cyber what??? – a systematic review. Journal of Applied Security Research, 21(1), 1–34. https://doi.org/10.1080/19361610.2025.2544184 DOI: https://doi.org/10.1080/19361610.2025.2544184
Google Scholar

Ho, G., Mirian, A., Luo, E., Tong, K., Lee, E., Liu, L. Voelker, G.M. (2025). Understanding the efficacy of phishing training in practice. In Proceedings of the IEEE Symposium on Security and Privacy (pp. 37–54). https://doi.org/10.1109/SP61157.2025.00076 DOI: https://doi.org/10.1109/SP61157.2025.00076
Google Scholar

ISO/IEC 27001:2022 Information Security, Cybersecurity and Privacy Protection – Information Security Management Systems – Requirements. (2022). International Organization for Standardization.
Google Scholar

Jean, B., Myriam, M. (2025). Decoding cybersecurity: how terminology shapes the field. In ESREL SRA-E 2025. Research Publishing. https://doi.org/10.3850/978-981-94-3281-3_ESREL-SRA-E2025-P5323-cd DOI: https://doi.org/10.3850/978-981-94-3281-3_ESREL-SRA-E2025-P5323-cd
Google Scholar

Kapko, M. (2025). Research shows data breach costs have reached an all-time high. CyberScoop, 30.07. https://cyberscoop.com/ibm-cost-data-breach-2025/ [accessed: 18.01.2026].
Google Scholar

Karger, P.A., Schell, R.R. (2002). Thirty years later: lessons from the Multics security evaluation. In 18th Annual Computer Security Applications Conference, 2002. Proceedings (pp. 119–126). IEEE. https://doi.org/10.1109/CSAC.2002.1176291 DOI: https://doi.org/10.1109/CSAC.2002.1176285
Google Scholar

Kour, R., Karim, R., Dersin, P., Venkatesh, N. (2024). Cybersecurity for Industry 5.0: trends and gaps. Frontiers in Computer Science, 6, 1434436. https://doi.org/10.3389/fcomp.2024.1434436 DOI: https://doi.org/10.3389/fcomp.2024.1434436
Google Scholar

Lineman, D. (2023). Security policies, standard and procedures: what’s the difference? Information Shield, 27.10. https://informationshield.com/2023/10/27/security-policies-standard-and-procedures-whats-the-difference/ [accessed: 18.01.2026].
Google Scholar

Liu, M., Shore, M., Yeoh, W., Jiang, F., Zeadally, S. (2025). Toward effective cybersecurity management: a hierarchical process model with performance assessment. Journal of Cybersecurity, 11(1), tyaf020. https://doi.org/10.1093/cybsec/tyaf020 DOI: https://doi.org/10.1093/cybsec/tyaf020
Google Scholar

Masukawa, R., Yun, S., Jeong, S., Bastian, N.D., Imani, M. (2025). TriageHD: A Hyper Dimensional Learning to Rank Framework for Dynamic Micro Segmentation in Zero Trust Network Security. IEEE Access, 13, 136806–136815. https://doi.org/10.1109/ACCESS.2025.3592877 DOI: https://doi.org/10.1109/ACCESS.2025.3592877
Google Scholar

Mhaskar, N., Alabbad, M., Khedri, R. (2021). A formal approach to network segmentation. Computers & Security, 103, 102162. https://doi.org/10.1016/j.cose.2020.102162 DOI: https://doi.org/10.1016/j.cose.2020.102162
Google Scholar

Morris, J., Tatschner, S., Heinl, M.P., Heinl, P., Newe, T., Plaga, S. (2024). Cybersecurity as a service. In K. Naseer Qureshi, T. Newe, G. Jeon, A. Chehri (Eds.), Cybersecurity Vigilance and Security Engineering of Internet of Everything (pp. 130–145). Springer (Internet of Things). https://doi.org/10.1007/978-3-031-45162-1_9 DOI: https://doi.org/10.1007/978-3-031-45162-1_9
Google Scholar

The NIST Cybersecurity Framework 2.0. (2024). National Institute of Standards and Technology, 26.02. https://doi.org/10.6028/NIST.CSWP.29 DOI: https://doi.org/10.6028/NIST.CSWP.29
Google Scholar

ISO 27001:2022. Information Security Implementation Guide. NQA. https://www.nqa.com/getmedia/ae12c945-4dbb-4b73-a4e3-996261a540af/NQA-ISO-27001-Implementation-Guide.pdf [accessed: 18.01.2026].
Google Scholar

Oliveira, S., Leal, A.B., Teixeira, M., Lopes, Y.K. (2023). A classification of cybersecurity strategies in the context of discrete event systems. Annual Reviews in Control, 56, 100907. https://doi.org/10.1016/j.arcontrol.2023.100907 DOI: https://doi.org/10.1016/j.arcontrol.2023.100907
Google Scholar

Pinninti, V.P. (2025). Automating governance, risk, and compliance (GRC) in cloud computing: a case study on ServiceNow and NIST framework integration. Internet of Things and Cloud Computing, 13(4), 77–86. https://doi.org/10.11648/j.iotcc.20251304.11 DOI: https://doi.org/10.11648/j.iotcc.20251304.11
Google Scholar

Policy vs standard vs control vs procedure. (n.d.). Compliance Forge. https://complianceforge.com/grc/policy-vs-standard-vs-control-vs-procedure [accessed: 18.01.2026].
Google Scholar

Radanliev, P. (2025). Red teaming quantum-resistant cryptographic standards: a penetration testing framework integrating AI and quantum security. Journal of Defense Modeling and Simulation, 1–18. https://doi.org/10.1177/15485129251364901 DOI: https://doi.org/10.2139/ssrn.5532804
Google Scholar

Rahman, T., Rohan, R., Pal, D., Kanthamanon, P. (2021). Human factors in cybersecurity: a scoping review. In Proceedings of the 12th International Conference on Advances in Information Technology (pp. 1–11). https://doi.org/10.1145/3468784.3468789 DOI: https://doi.org/10.1145/3468784.3468789
Google Scholar

Raxmonberdiyeva, S. (2025). Differences between information security and cybersecurity. Modern Science and Research, 4(6), 234–237. https://inlibrary.uz/index.php/science-research/article/view/104279
Google Scholar

Salfati, E., Pease, M. (2022). Digital Forensics and Incident Response (DFIR) Framework for Operational Technology (OT). NIST IR 8428. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.IR.8428 DOI: https://doi.org/10.6028/NIST.IR.8428
Google Scholar

Siponen, M., Willison, R. (2009). Information security management standards: problems and solutions. Information & Management, 46(5), 267–270. https://doi.org/10.1016/j.im.2008.12.007 DOI: https://doi.org/10.1016/j.im.2008.12.007
Google Scholar

Spira, L.F., Page, M. (2003). Risk Management: The Reinvention of Internal Control and the Changing Role of Internal Audit. ICAEW. DOI: https://doi.org/10.1108/09513570310492335
Google Scholar

Tarling, K. (2023). The Service Organization. London Publishing Partnership.
Google Scholar

Teichmann, F.M., Boticiu, S.R. (2023). An overview of the benefits, challenges, and legal aspects of penetration testing and red teaming. International Cybersecurity Law Review, 4, 387–397. https://doi.org/10.1365/s43439-023-00100-2 DOI: https://doi.org/10.1365/s43439-023-00100-2
Google Scholar

Valcesia, T.M., Rigo, A.L. (2019). Physical or virtual firewall for perimeter protection in cloud computer infrastructure. In 16th CONTECSI – International Conference on Information Systems and Technology Management. https://doi.org/10.5748/16CONTECSI/ITM-6115 DOI: https://doi.org/10.5748/16CONTECSI/ITM-6115
Google Scholar

Vargo, S.L., Lusch, R.F. (2004). Evolving to a new dominant logic for marketing. Journal of Marketing, 68(1), 1–17. https://doi.org/10.1509/jmkg.68.1.1.24036 DOI: https://doi.org/10.1509/jmkg.68.1.1.24036
Google Scholar

Vielberth, M., Böhm, F., Fichtinger, I., Pernul, G. (2020). Security operations center: a systematic study and open challenges. IEEE Access, 8, 227756–227775. https://doi.org/10.1109/ACCESS.2020.3045514 DOI: https://doi.org/10.1109/ACCESS.2020.3045514
Google Scholar

Wagner, T.D., Mahbub, K., Palomar, E., Abdallah, A.E. (2020). Cyber threat intelligence sharing: survey and research directions. Computers & Security, 87, art. 101589. https://doi.org/10.1016/j.cose.2019.101589 DOI: https://doi.org/10.1016/j.cose.2019.101589
Google Scholar

Werlinger, R., Hawkey, K., Beznosov, K. (2009). An integrated view of human, organizational, and technological challenges of IT security management. Information Management & Computer Security, 17(1), 4–19. https://doi.org/10.1108/09685220910944722 DOI: https://doi.org/10.1108/09685220910944722
Google Scholar

Wilson, S., Hamilton, D., Stallbaum, S. (2020). The unaddressed gap in cybersecurity: human performance. MIT Sloan Management Review, 26.05. https://sloanreview.mit.edu/article/the-unaddressed-gap-in-cybersecurity-human-performance/ [accessed: 18.01.2026].
Google Scholar

Yan, D. (2020). A systems thinking for cybersecurity modeling. arXiv preprint, arXiv:2001.05734. https://arxiv.org/pdf/2001.05734 [accessed: 18.01.2026].
Google Scholar