A Holistic Cybersecurity Maturity Assessment Framework for Higher Education Institutions in the United Kingdom
Source abstract
Abstract
As organisations are vulnerable to cyberattacks, their protection becomes a significant issue. Capability Maturity Models can enable organisations to benchmark current maturity levels against best practices. Although many maturity models have been already proposed in the literature, a need for models that integrate several regulations exists. This article presents a light, web-based model that can be used as a cybersecurity assessment tool for Higher Education Institutes (HEIs) of the United Kingdom. The novel Holistic Cybersecurity Maturity Assessment Framework incorporates all security regulations, privacy regulations, and best practices that HEIs must be compliant to, and can be used as a self assessment or a cybersecurity audit tool.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Information and Cyber Security · Network Security and Intrusion Detection · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Computer Science and Informatics, De Montfort University, Leicester LE1 9BH, UK
Funding
National Cyber Security Centre - UK
References (32)
Show source-provided references
1. Chapman, J., and Francis, J. (2019). Cyber Security Posture Survey Results 2019, Joint Information Systems Committee (JISC).
2. Katz, F.H. (2005). The effect of a university information security survey on instruction methods in information security. Proceedings of the 2nd Annual Conference on Information Security Curriculum Development, Association for Computing Machinery.10.1145/1107622.1107633 ↗
3. Recommendations for information security awareness training for college students10.1108/IMCS-01-2013-0005 ↗
4. Kaspersky, G.C.I. (2013). Global Corporate IT Security Risks: 2013, Kaspersky Lab.
5. The need for effective information security awareness
6. HEART-IS: A novel technique for evaluating human error-related information security incidents10.1016/j.cose.2018.09.002 ↗
7. Cook, A., Smith, R., Maglaras, L., and Janicke, H. (2016). Using Gamification to Raise Awareness of Cyber Threats to Critical National Infrastructure, BCS.10.14236/ewic/ICS2016.10 ↗
8. Rajewski, J. (2020, May 22). Cyber Security Awareness: Why Higher Education Institutions Need to Address Digital Threats. Available online: https://www.huffpost.com/entry/cyber-security-awareness-_b_4025200.
9. Maglaras, L., Ferrag, M.A., Derhab, A., Mukherjee, M., Janicke, H., and Rallis, S. (2019). Threats, Protection and Attribution of Cyber Attacks on Critical Infrastructures. arXiv.10.4108/eai.15-10-2018.155856 ↗
10. Butkovic, M.J., and Caralli, R.A. (2020, May 22). Advancing Cybersecurity Capability Measurement Using the CERT-RMM Maturity Indicator Level Scale. Available online: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=69187.
11. Characterizing the software process: A maturity framework10.1109/52.2014 ↗
12. Caralli, R., Knight, M., and Montgomery, A. (2012). Maturity Models 101: A Primer for Applying Maturity Models to Smart Grid Security, Resilience, and Interoperability, Carnegie-Mellon University, Software Engineering Institute. Technical Report.10.21236/ADA610461 ↗
13. Abramowicz, W., and Paschke, A. (2018). Information Security Management Systems—A Maturity Model Based on ISO/IEC 27001. Business Information Systems, Springer International Publishing.10.1007/978-3-319-93931-5 ↗
14. Humphreys, E. (2016). Implementing the ISO/IEC 27001: 2013 ISMS Standard, Artech House.
15. Brewer, D. (2013). An Introduction to ISO/IEC 27001: 2013, BSI Standard Limited.10.3403/9780580821653 ↗
16. Barrett, M. (2018). Framework for Improving Critical Infrastructure Cybersecurity, National Institute of Standards and Technology. Technical Report.
17. Sabillon, R., Serra-Ruiz, J., Cavaller, V., and Cano, J. (2017, January 23–25). A comprehensive cybersecurity audit model to improve cybersecurity assurance: The cybersecurity audit model (CSAM). Proceedings of the 2017 International Conference on Information Systems and Computer Science (INCISCOS), Quito, Ecuador.10.1109/INCISCOS.2017.20 ↗
18. Adler, R.M. (2013, January 12–14). A dynamic capability maturity model for improving cyber security. Proceedings of the 2013 IEEE International Conference on Technologies for Homeland Security (HST), Waltham, MA, USA.10.1109/THS.2013.6699005 ↗
19. Information security maturity model for NIST cyber security framework
20. Cybersecurity capability maturity models for providers of critical infrastructure10.22215/timreview/837 ↗
21. Akinsanya, O.O., Papadaki, M., and Sun, L. (2019). Current Cybersecurity Maturity Models: How Effective in Healthcare Cloud?.
22. Le, N.T., and Hoang, D.B. (2016, January 9–11). Can maturity models support cyber security?. Proceedings of the 2016 IEEE 35th International Performance Computing and Communications Conference (IPCCC), Las Vegas, NV, USA.10.1109/PCCC.2016.7820663 ↗
23. Akinsanya, O.O., Papadaki, M., and Sun, L. (2019). Towards a maturity model for health-care cloud security (M2HCS). Inf. Comput. Secur.10.1108/ICS-05-2019-0060 ↗
24. Team, C.P. (2002). Capability maturity model® integration (CMMI SM), version 1.1. CMMI Product Team, “CMMI for Systems Engineering/Software Engineering/Integrated Product and Process Development/Supplier Sourcing, Version 1.1, Staged Representation (CMMI-SE/SW/IPPD/SS, V1.1, Staged)”, Software Engineering Institute, Carnegie Mellon University. Technical Report CMU/ SEI-2002-TR-012.
25. Keller, N. (2019). CIS Controls Informative Reference Details.
26. ENISA (2018). Guidelines on Assessing DSP Security and OES Compliance with the NISD Security Requirements.
27. Mbanaso, U.M., Abrahams, L., and Apene, O.Z. (2019). Conceptual Design of a Cybersecurity Resilience Maturity Measurement (CRMM) Framework. Afr. J. Inf. Commun., 1–26.
28. Butkovic, M., and Caralli, R. (2013). Advancing Cybersecurity Capability Measurement Using the CERT-RMM Maturity Indicator Level Scale, Software Engineering Institute, Carnegie Mellon University. Technical Report CMU/SEI-2013-TN-028.
29. The new EU cybersecurity framework: The NIS Directive, ENISA’s role and the General Data Protection Regulation10.1016/j.clsr.2019.06.007 ↗
30. Lachaud, E. (2020, May 22). ISO/IEC 27701: Threats and Opportunities for GDPR Certification. Available online: https://research.tilburguniversity.edu/en/publications/isoiec-27701-threats-and-opportunities-for-gdpr-certification.10.2139/ssrn.3521250 ↗
31. Privacy in crises: The NIST privacy framework10.1111/1468-5973.12143 ↗
32. Ferrag, M.A., Maglaras, L., and Janicke, H. (2019). Blockchain and its role in the internet of things. Strategic Innovative Marketing and Tourism, Springer.10.1007/978-3-030-12453-3_119 ↗