Cyber-attacks are exponentially growing, and their impact on systems, people, and organizations increases. Among other challenges, cyber-attacks prevention must tackle the fact that many software... Show moreCyber-attacks are exponentially growing, and their impact on systems, people, and organizations increases. Among other challenges, cyber-attacks prevention must tackle the fact that many software systems are marketed with security vulnerabilities due to the companies’ need to reduce time-to-market. One strategy to reduce security vulnerabilities is ethical hacking. However, while ethical hacking can bring many advantages, it also comes with many challenges. This paper introduces a comprehensive study of the possibilities and limitations of ethical hacking in Spain, both empirical and normative. On the empirical side, the paper presents the results of a Delphi study with cyber security experts in Spain on their opinions about the regulation of ethical hacking. In the normative study, the paper critically reviews the possibilities open by the International, European and Spanish law for regulating ethical hacking. The conclusions of this paper offer a roadmap for harnessing ethical hacking to improve cyber security. Show less
While cyberspace has become central to all vital processes in our global economy and our social lives it also carries a wide variety of risks. Framing these risks is no easy feat: some lead to harm... Show moreWhile cyberspace has become central to all vital processes in our global economy and our social lives it also carries a wide variety of risks. Framing these risks is no easy feat: some lead to harm in cyberspace itself, while others lead to harm in the offline world as well. Moreover, sometimes harm is brought about intentionally, while at other times it may be the result of accidents. The ‘cyber harm model’ brings these challenges together, and provides us with an opportunity to get a comprehensive overview of the different types of incidents related to cyberspace. It also reveals where the biggest challenges for cyber crisis management lie and it provides us with a typology of different types of cyber crises that may arise. Cyber-induced crises have characteristics that make them hard to grapple with, for instance the fact that they can be induced remotely and instantaneously at multiple locations. Moreover, cyber crises are not always easily traceable, and sometimes it is difficult to see that the cause of a particular crisis in the offline world is an act in cyberspace. Finally, the borderless nature of cyberspace leads to potential large-scale geographical spread for cyber crises. Cyber crises also lead to a number of specific challenges for leadership, especially with respect to sense-making, meaning-making, decision-making, termination and learning. Show less
This paper investigates whether and how the twin UN processes of the UN Group of Governmental Experts (UN GGE) and the OpenEnded Working Group (OEWG) are willing and able to address two ‘below-the... Show moreThis paper investigates whether and how the twin UN processes of the UN Group of Governmental Experts (UN GGE) and the OpenEnded Working Group (OEWG) are willing and able to address two ‘below-the-threshold’ problems in their deliberations. The call for the protection of the public core of the internet and the call for the protection against foreign election interference have been flagged by many state and non-state parties for consideration by both processes. This paper analyses the threats that the vulnerability of the public core of the internet and foreign election interfere pose for stability in cyberspace, as well as the legal and normative proposals that have been suggested to promote responsible state behaviour. On the basis of the public documents that states have submitted to the more transparent OEWG process, the contours are sketched of what the inclusion of these issues in possible consensus reports for both processes may look like. The OEWG concluded its deliberations with a consensus report that addresses some aspects of these issues, shifting the task of further elaboration and guidance firstly onto the ongoing UN GGE process, as well as onto the new OEWG 2021–2025 and other UN processes that are emerging. Show less
In the last two decades, Israel established itself as a leading actor in the global arena of cyber security governance, strategy, and industry. Transferring knowledge from the military to the... Show moreIn the last two decades, Israel established itself as a leading actor in the global arena of cyber security governance, strategy, and industry. Transferring knowledge from the military to the civilian sphere, the country can today be considered as a normative power for its cyber security policies, research, and innovative market ventures. Thanks to their notorious – yet contentious – operations, the Israel Defense Forces (IDF) are internationally recognized as pioneers in the field of offensive cyber defense. Different elements contribute to Israel’s national success in cyber security, and this chapter maps them through a critical perspective on the country’s conflation of military strategies with cyber security governance and market initiatives. This problematic merging of different domains creates in fact the conditions for a distinctive – and growlingly exported abroad – profitable approach to the securitization and militarization of cyberspace. Show less
