<?xml version="1.0" encoding="UTF-8"?><xml><records><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>27</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Venelin Georgiev</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Comparative Analysis of Models for Assessing the Maturity of Cybersecurity Capabilities</style></title><secondary-title><style face="normal" font="default" size="100%">IT4Sec Reports</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">assessment</style></keyword><keyword><style  face="normal" font="default" size="100%">capabilities</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber resilience</style></keyword><keyword><style  face="normal" font="default" size="100%">Cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">cybersecurity areas</style></keyword><keyword><style  face="normal" font="default" size="100%">maturity level</style></keyword><keyword><style  face="normal" font="default" size="100%">measurement</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2021</style></year></dates><number><style face="normal" font="default" size="100%">138</style></number><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">&lt;p&gt;The examination of all issues of interest in the field of cybersecurity, cyber resilience and the fight against cybercrime can be focused on one term, and that is the term cybersecurity capabilities. Cybersecurity capabilities demonstrate the ability to implement policies, standards, guidelines, and operational procedures for the security of information systems, networks, applications, and information. In turn, cybersecurity capabilities are a dynamic object that is built, maintained, developed, modified and adapted to the changing security environment. The dynamics of security capabilities require measuring the degree of their maturity and comparing them with the target levels. This report provides a comparative analysis of existing models for assessing the maturity of cybersecurity capabilities, thus creating an opportunity for a reasonable choice of such a method for the needs of specific assessment.&lt;/p&gt;</style></abstract></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">George Sharkov</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Assessing the Maturity of National Cybersecurity and Resilience</style></title><secondary-title><style face="normal" font="default" size="100%">Connections: The Quarterly Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">capability maturity models</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber resilience</style></keyword><keyword><style  face="normal" font="default" size="100%">cybersecurity maturity assessment</style></keyword><keyword><style  face="normal" font="default" size="100%">hybrid resilience</style></keyword><keyword><style  face="normal" font="default" size="100%">maturity indicators</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2020</style></year><pub-dates><date><style  face="normal" font="default" size="100%">Fall 2020</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">19</style></volume><pages><style face="normal" font="default" size="100%">5-24</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">This article provides an overview of maturity levels and assessment methodologies for the evaluation of cybersecurity and resilience in relation to their applicability and usefulness at sectoral and national levels. Reference maturity models and assessment frameworks, such as CERT Resilience Management Model, Cybersecurity Capacity Maturity Model for Nations, C2M2 (Cybersecurity Capability Maturity Model), are compared and analyzed for their applicability in designing and implementing national cybersecurity strategies and programs to achieve cyber resilience. Cyber readiness indexes are also outlined in view of their use to indicate possible improvements. The author explores the development of national cybersecurity strategies with a focus on cyber maturity and provides examples. A maturity-based approach for the Bulgarian cyber resilience roadmap is also described within the context of the evolving cyber-empowered hybrid threats and the need for an institutionalized collaborative public-private resilience.</style></abstract><issue><style face="normal" font="default" size="100%">4</style></issue><section><style face="normal" font="default" size="100%">5</style></section></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Todor Tagarev</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">DIGILIENCE - A Platform for Digital Transformation,  Cyber Security and Resilience</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">artificial intelligence</style></keyword><keyword><style  face="normal" font="default" size="100%">cooperation</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber resilience</style></keyword><keyword><style  face="normal" font="default" size="100%">Cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">DIGILIENCE</style></keyword><keyword><style  face="normal" font="default" size="100%">digital transformation</style></keyword><keyword><style  face="normal" font="default" size="100%">emerging technologies</style></keyword><keyword><style  face="normal" font="default" size="100%">human factors</style></keyword><keyword><style  face="normal" font="default" size="100%">hybrid influence</style></keyword><keyword><style  face="normal" font="default" size="100%">industry 4.0</style></keyword><keyword><style  face="normal" font="default" size="100%">information sharing</style></keyword><keyword><style  face="normal" font="default" size="100%">intuitionist fuzzy logic</style></keyword><keyword><style  face="normal" font="default" size="100%">social networks</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2019</style></year></dates><volume><style face="normal" font="default" size="100%">43</style></volume><pages><style face="normal" font="default" size="100%">7-10</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">&lt;p&gt;The ongoing digital transformation requires significant investments and innovation to provide security of cyberspace and variety of critical infrastructures and essential services that increasingly depend on the digital infrastructure, as well as to enhance the resilience of organizations, communities, industries, nations, and alliances in the face of malicious use of cyberspace.&lt;/p&gt;&lt;p&gt;This volume presents 28 of the papers, accepted for presentation at the DIGILIENCE 2019 conference, dealing with cyber information sharing and situational awareness, the benefits and challenges of emerging technologies, such as artificial intelligence, the human factor, education and training for cyber security and resilience, the need to incorporate the cybersecurity efforts into the search for effective and efficient exploitation of information technologies, policies and solutions for security and resilience of Industry 4.0 and critical infrastructures, analysing and countering hybrid influence through social networks and more traditional media. The DIGILIENCE series of conferences will promote the sharing of knowledge and experience and facilitate the spread of good practice in IT governance, cyber security and resilience.&lt;/p&gt;</style></abstract><issue><style face="normal" font="default" size="100%">1</style></issue></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>47</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Velizar Shalamanov</style></author><author><style face="normal" font="default" size="100%">Silvia Matern</style></author><author><style face="normal" font="default" size="100%">Georgi Penchev</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Digitalization and Cyber Resilience Model for the Bulgarian Academy of Sciences</style></title><secondary-title><style face="normal" font="default" size="100%">DIGILIENCE 2019</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">change management</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber resilience</style></keyword><keyword><style  face="normal" font="default" size="100%">digitalization</style></keyword><keyword><style  face="normal" font="default" size="100%">innovation management</style></keyword><keyword><style  face="normal" font="default" size="100%">personnel management</style></keyword><keyword><style  face="normal" font="default" size="100%">portfolio management</style></keyword><keyword><style  face="normal" font="default" size="100%">service management</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2019</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2-4 October</style></date></pub-dates></dates><pub-location><style face="normal" font="default" size="100%">Sofia, Bulgaria</style></pub-location><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">&lt;p&gt;This paper presents a concept for digital transformation of the Bulgarian Academy of Sciences &amp;ndash; a national academic institution for both fundamental and applied research and education. It looks into four areas &amp;ndash; project management; services; funding; and people to develop, operate and protect ICT infrastructure and applications. It explores options for these four areas, suggests an approach to select the most suitable ones, and the way of their integration through effective system for governance and management in the specific environment.&lt;/p&gt;&lt;p&gt;This paper is included in the program of &lt;a href=&quot;https://digilience.org&quot;&gt;DIGILIENCE 2019&lt;/a&gt; and will be published in the post-conference volume.&lt;/p&gt;</style></abstract></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Velizar Shalamanov</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Organising for IT Effectiveness, Efficiency and Cyber Resilience in the Academic Sector: National and Regional Dimensions</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">consolidation</style></keyword><keyword><style  face="normal" font="default" size="100%">coordination</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber resilience</style></keyword><keyword><style  face="normal" font="default" size="100%">governance model</style></keyword><keyword><style  face="normal" font="default" size="100%">network governance</style></keyword><keyword><style  face="normal" font="default" size="100%">regional cooperation</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2019</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2019</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">42</style></volume><pages><style face="normal" font="default" size="100%">49-66</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">This article presents an architecture and analysis of the change management aspects of security in public administration, developed as part of a study of best practices in the management of IT organisations with emphasis on effectiveness, efficiency and cyber resilience. The analysis served as a basis for defining a model of academic support to cyber resilience. The implementation envisions use of the BEST environment (Basic/budget Environment for Simulation and Training), which was initially developed for the crisis management domain and later adapted to support organisational and human risks analysis in the cyber domain in research and training activities on cyber resilience. This environment is used for PESTEL analysis of the cyber environment to identify a model for resilience from organisational and human perspective and to support SWOT assessment of the possible implementation paths in order to select the most suitable among all qualified solutions and provide training of the personnel involved. Regional aspects of cyber resilience are addressed in the context of the NATO/EU framework, limited to the academic area. Finally, the article addresses organisational and human aspects and presents a concept of an Academic CERT Association at national level and the possibilities to use it as a model for a regional network.</style></abstract><section><style face="normal" font="default" size="100%">49</style></section></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">George Sharkov</style></author><author><style face="normal" font="default" size="100%">Christina Todorova</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Capture the Flag for Cyber-Resilience Exercising through Cryptographic Puzzles and Collaborative Problem-Solving</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">capture the flag</style></keyword><keyword><style  face="normal" font="default" size="100%">collaboration</style></keyword><keyword><style  face="normal" font="default" size="100%">cryptography</style></keyword><keyword><style  face="normal" font="default" size="100%">CTF</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber resilience</style></keyword><keyword><style  face="normal" font="default" size="100%">problem-solving</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2017</style></year></dates><volume><style face="normal" font="default" size="100%">37</style></volume><pages><style face="normal" font="default" size="100%">95-102</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">The importance of cybersecurity in the digital society and our daily lives is becoming increasingly apparent. With the rise of digital reliance, securing information, whether this information is at rest, in transit, or in use, is vital to ensuring the interoperability of systems, including critical infrastructure, on which society’s physical well-being depends. Cryptography is well-known for its role in cybersecurity as a crucial tool for protecting information exchanged via digital devices. 
Cryptography is the science of concealing information so that only the intended parties can read it. As a result, we may generalise that cryptography enables people to communicate via the Internet while securely sending critical and secret information. However, cryptography is a relatively complex combination of mathematics and computer science, where typical learning methodologies may fall short when it comes to achieving hands-on expertise. This paper provides an overview of the possibilities of Capture the Flag (CTF) exercises to test cybersecurity capabilities using collaborative methodologies and cryptographic challenges.</style></abstract></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">George Sharkov</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">A System-of-Systems Approach to Cyber Security and Resilience</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">collaboration-oriented architecture</style></keyword><keyword><style  face="normal" font="default" size="100%">composite cyber risk</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber picture</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber resilience</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber risks</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber threats</style></keyword><keyword><style  face="normal" font="default" size="100%">de-perimetrization</style></keyword><keyword><style  face="normal" font="default" size="100%">Situational awareness</style></keyword><keyword><style  face="normal" font="default" size="100%">system-of-systems</style></keyword><keyword><style  face="normal" font="default" size="100%">zero trust model</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2017</style></year></dates><volume><style face="normal" font="default" size="100%">37</style></volume><pages><style face="normal" font="default" size="100%">69-94</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">To address the cybersecurity, safety, and reliability aspects of the entire digitalized ecosystems, we need first to understand and possibly model how the respective computer systems of different participating entities interoperate and collaborate. Modern computer systems and emerging applications are not just largescale and complex in the digitally connected world. We categorize them also as decentralized, distributed, networked, interoperable compositions of heterogeneous and (semi)autonomous systems and/or elements. These new types of composite systems with emergent behavior have been defined as “Systems of Systems” (SoS). This paper explores different types of SoS and analyzes the interdependencies to manage cybersecurity threats and risks and achieve cyber resilience. We review various definitions and types of SoS and the application of SoS approach to situational awareness, threat intelligence, and composite risk assessment. An SoS view on managing the supply/value chain cyber risks is also outlined.</style></abstract></record></records></xml>