Add your Insight
28 February 2021
COVID-19 Pandemic Crisis and its Implications on Cybersecurity
COVID-19 pandemic crisis has impacted our lives and changed many daily routines in a considerably short time. COVID-19 has brought various technical and organizational challenges that require a thorough understanding and reassessing of our methods and tools in the cybersecurity area. It is highly likely that some of such changes may be permanent or continue in other forms in the post-COVID-19 era. It is timely to think about our crisis management capabilities, bring quick solutions to the ongoing situation, and assess the implications in cyber security. This special issue aims to contribute to the literature with high quality and original articles addressing COVID-19 related cyber security topics.
The COVID-19 crisis has strengthened and reshaped our society's dependency on ICT and the Internet due to the more widely adopted remote working and distance learning practices. The malicious actors have rapidly adapted to these changes, and this, in turn, has led to some shifts in attack surfaces and methods. Personal computing devices have been extensively utilized for work purposes. Video conferencing tools have become the primary environment for meeting, reliance on remote connectivity services, and corporate VPNs have ramped up, and cloud services have justified their usefulness. The hackers have redirected their attention to these systems as initial entry points to the target systems. Social engineering attack vectors have abused the COVID-19 related information dissemination activities about health guidance or news about virus spread. Phishing and ransomware campaigns have been adjusted to this new situation (e.g., malicious code is embedded into COVID maps). Some sectors, such as health, retail, and logistics, have had greater importance, thus, attracted more cyberattacks than usual. Software development lifecycles have had to run quickly for combating with the virus and its implications on business processes, but most of the time, at the cost of sacrificing the secure development principles. Supply-chains have undergone significant changes without a proper evaluation of third party-related risks. Security operation centres suffer a shortage of staff in pandemic
times. Government and organizations have developed crisis management tools that have created various privacy-related concerns.
We need to develop risk, vulnerability, and asset management methods/tools that can be adaptive to the sudden shifts in the organizational/sectoral/global security posture due to the crises similar to the COVID-19. Effective and efficient secure development life cycle (SDLC) methods such as threat modelling, security requirement derivation, and security testing, which are applicable in crises should be developed. Intrusion detection systems, spam/phishing filters, and malware scanners, especially those using anomaly-based systems should detect the sudden shifts in the data that occurred due to user patterns, customer profiles, network communications, working hours and operating procedures. The processes, such as incident handling, vulnerability management, and threat monitoring, should be optimized to handle the shortage of staff in security operating centres. The response capabilities of business continuity plans to the global crises should be analyzed. Cybersecurity challenges and solutions should be investigated mainly in the health, retail, and logistics sectors. The global, national, and sector-based information-sharing mechanisms should be addressed. We need to understand the trade-off between the privacy requirements and rapid reaction to the crisis and develop methods that adequately assess the privacy impact of systems under extreme situations. Society needs technical and regulatory adaptations to handle changing privacy needs. Governments should work on the effects of cyber landscape changes on national cybersecurity policies and strategies. Specifically, as a response to the COVID-19 crisis, a systematic analysis should be conducted to understand the changes in asset and cyber threat profiles. It could be possible that the cyber security domain can learn from the experience of the health sector about handling a global-scale crisis.
Topics of interest include, but are not limited to:
From a COVID-19 perspective:
- Adaptive risk, vulnerability and asset management systems
- Risks of work from home and mitigation strategies
- Global, national and sector-based information sharing
- The policy-based and technical methods of limiting distribution of rumours, misinformation, and propaganda
- Cybersecurity practices in sectors including health, retail, and logistics
- Optimization of incident handling, vulnerability identification and threat management processes in security operating centres
- Changes in the cybercrime landscape and new malicious behaviour patterns such as phishing and ransomware campaigns
- Evaluation of intrusion detection/security monitoring systems according to the changes in the threat landscape
- Third-party and supply-chain risks
- Secure development life cycles and improving their effectiveness in crises
- Cyber crisis management during a pandemic
- Privacy issues related to contact tracing from both technical and legal perspectives (e.g., GDPR)
- Privacy-preserving contact tracing applications
Looking to Publish your Research?
We aim to make publishing with Taylor & Francis a rewarding experience for all our authors. Please visit our Author Services website for more information and guidance, and do contact us if there is anything we can help with!
Submission Deadline: 28th February 2021
High quality and original research papers and review articles will be accepted.
Please, select the special issue title when submitting your paper to ScholarOne.
The accepted papers will be published in the first half of 2021.
View the latest tweets from tandfstem