# CAMS Research

## CAMS Research Framework

Successful cybersecurity leadership covers four critical areas shown in the pillars of our research program framework.

See **{entry("research-priorities-2022-2023").files().first().link(text="CAMS Research Priorities for 2022-2023")}** (PDF).

{ "$CAMS_HOUSE_OF_SECURITY$" }

## [Research Briefs](/research-briefs)

{ allEntries().filter(entryType=entryType("research-brief")).annotate(showMore=false) }

[More research briefs...](/research-briefs)

## [Posters and Presentations](/posters-presentations)

{ allEntries().filter(entryType=entryType("poster-presentation")).withDetail(prop=prop("date-published")).sort(by=(e -> e.detail), reverse=true).annotate(showMore=false) }

[More posters & presentations...](/posters-presentations)

## [Early Papers](/early-papers)

{ allEntries().filter(entryType=entryType("early-paper")).withDetail(prop=prop("date-published")).sort(by=(e -> e.detail), reverse=true).annotate(showMore=false) }

[More early papers...](/early-papers)

## By Author

Explore papers written by individual CAMS researchers:

* { entry("stuart-madnick") }
* { entry("michael-siegel") }
* { entry("keri-pearlson") }

Creating a Cybersecurity Culture: (ISC)2 Survey Responses

Today, in order to be successful, every organization needs to be cyber secure. Cybersecurity is the practice of protecting the confidentiality, integrity, and availability of critical organizational assets. However, this practice can be complex and time-consuming, and typically is not the primary strategic goal for the majority of organizations. Conversely, compliance is one of the most powerful motivating forces behind most business investments due to the financial or reputational impact it may have. Compliance is generally defined as the act of conforming to rules or policies. In most industries, ensuring the application of these rules or policies often means meeting a third party’s regulatory requirements, such as a government or a cybersecurity framework. Nevertheless, meeting compliance regulations doesn't necessarily enable an organization to cover all cybersecurity needs. This means that achieving the highest level in compliance doesn't often mean that is also possible to achieve an equally high level in cybersecurity. The research question for this study is: To what extent does compliance help or hinder security for the organization – and why/how. Therefore, when trying to understand the interplay between compliance and cybersecurity, generally, two scenarios may occur: compliance helps security, or compliance hinders security.

Research Plan to Analyze the Role of Compliance in Influencing Cybersecurity in Organizations

Sometimes it seems as if everyone has bought into the hype: Industries as far-flung as real estate and diamond sales1 have embraced blockchain without entirely knowing what it is or how its most vaunted features might fail or have unintended consequences. Blockchain assures users that once information has been stored, it can never be deleted or falsified. This means that when people in finance, say, pore over the history of a transaction, they feel content in the knowledge that illegalities have nowhere to hide. It means that people in the supply chain of a product trust that they can check its provenance without fear that misinformation has slipped in along the way. In essence, blockchain promises not just complete data security but also something more intangible: that we will never be conned. Is it really so important that we understand what’s under the hood?
The truth is that blockchain is not as secure as it is believed to be, and its features can rebound in unfortunate ways. In research I conducted with Jae Lee, described in detail in his graduate thesi forthcoming paper for the Cybersecurity at MIT Sloan (CAMS) initiative, we cataloged 72 breaches between 2011 and 2018. These breaches cost users a grand total of more than $2 billion. Many breaches were possible because blockchain is actually vulnerable in some of the same ways that conventional, centralized record-keeping systems are. The rest are even more troubling, because were able to exploit the very features that make blockchain revolutionary: transparency, distribu anonymity, and immutability. In this article, we will look closely at both categories of vulnerabil organizations can weigh the risks and decide whether to make use of blockchain.

Blockchain Isn’t as Unbreakable as You Think

Recent world events and geopolitics have brought the vulnerability of critical infrastructure to cyberattacks to the forefront. While there has been considerable attention to attacks on Information Technology (IT) systems, the vulnerabilities and dangers posed by industrial control systems (ICS) have received significantly less attention. In this paper, we present a holistic, integrated safety and security analysis, we call Cybersafety, for one such industrial system – an industrial chiller plant – as an example. In this analysis, we identify vulnerabilities emerging from interactions between technology, operator actions as well as organizational structure, and provide recommendations to mitigate resulting loss scenarios in a systematic manner.

Protecting Chiller Systems from Cyberattack using a Systems Thinking Approach

Keri Pearlson

Abstract-- Physical control systems are increasingly controlled by reconfigurable, network-enabled devices to increase flexibility and ease commissioning and maintenance. Such capability creates vulnerabilities. Devices may be remotely reprogrammed by a malicious actor to act in unintended ways, causing physical damage to mechanical equipment, infrastructure, and life and limb. In this paper, past examples of actual damage to cyber- physical systems are shown, threats posed by software-controlled Variable Frequency Drives (VFDs) are analyzed, and a small-scale version of an attack on ubiquitous VFD equipment is demonstrated.

Identifying and Anticipating Cyber Attacks that Could Cause Physical Damage to Industrial Control Systems

Blockchain for Defensive Social Engineering

Develop a scenario-based simulator that assists energy delivery system operators during a cyber attack to avert unintended consequences.

Scenario-Based Simulator for Operational Resilience During a Cyber Attack

CAMS Research Priorities for 2022-2023

Understanding key mechanisms that form a cybersecurity culture will give managers specific levers to use to increase organizational resilience.

Building a Culture of Cybersecurity

Cutting Edge Cybersecurity Leadership Research at MIT’s Sloan School

Risk Management During COVID-19

This paper discusses cybersecure behaviors encouraged within Verizon Media and the managerial mechanisms they used to drive them, using the lens of the [Huang and Pearlson Cybersecurity Culture Model (2019)](/entry/for-what-technology-cant-fix).

Building a Security Propaganda Machine: The Cybersecurity Culture of Verizon Media

Michael Siegel

CAMS Research Program

Organizations are vulnerable to cyber-attacks partially because people in the organization are unaware of or unprepared for cyber risks. Building a culture of cybersecurity where the values, attitudes, and beliefs align with organizational goals of cyber resilience is of significant interest to managers and leaders in charge of cybersecurity in organizations today.
This research aims to provide practical tools for cybersecurity leaders to evaluate and improve the maturity of their organizational cybersecurity culture. This organizational cybersecurity culture model, named OCCM, is based on a systematic literature review, case studies, and workshop discussions. More specifically, to go beyond a literature review to identify the related components of organizational cybersecurity culture, we collected information through surveying individuals with knowledge of cyber practices in their companies, semi-structured interviews with willing participants, and voluntary workshop to discuss practices.
This survey was developed by Cybersecurity at MIT Sloan (CAMS) at MIT’s Sloan School of Management to verify the developed model and explore cybersecurity culture across organizations within different industries.
From June to December 2018, this project surveyed 187 individuals from 11 industries and 18 countries.

Building a Model of Cybersecurity Culture: Survey Results

Status Update: Research Exploring Malware in Energy Delivery Systems (REMEDYS)

GDPR Update

Issues of international trade policy have recently gained increased attention. Of course, restrictions on international trade regarding technology have long existed – on imports and exports, as well as on direct foreign investment in the United States. But cybersecurity has not been a key issue for trade policy – until now. This is because of the wide adoption of information and communications technologies (ICTs), like the Internet-of-Things (IoT), cloud computing, and big data analysis in the digital society. Almost every product is (or can be) Internet connected, including the critical infrastructures which military security, economic security and culture security heavily rely on. Hence cybersecurity has increasingly been invoked as a perspective of “national security,” which has been considered an important factor that impacts international trade and investment policy (Friedman, 2013; Kshetri, 2016; Mata, 2015)^[ Much research suggested that national security issues can significantly impact international trade and foreign direct investment policy. Please refer to the following literature for more details: (Friedman, 2013; Kshetri, 2016; Mata, 2015) ].

Framework for Understanding Cybersecurity Impacts on Digital Trade

Are you Adequately Protecting Against Increasing COVID-19 Cyber Threats?

Pharmaceutical and biotechnology companies offer an attractive target for cyberattacks because of their substantial investment in research and development, valuable intellectual property, connected IT and operational networks, and sensitive stores of data. According to the Cisco 2014 Annual Security Report, the Pharmaceutical Sector was a much greater target than other sectors. In fact, the amount of malware targeting Pharmaceuticals was just over 600% of the median across all industries. Consequences of a cyberattack can include stolen IP, repeated clinical trials, litigation, a frightening amount of lost revenue, and most importantly, damage to a company’s reputation. Victims of theft not only face massive internal issues but also find themselves targeted by class action lawsuits and regulatory actions.

Cybersecurity Management in Pharmaceutical and Biotechnology Industries — one page

Provides a framework to guide marketers and product designers on how to manage cybersecurity concerns of connected devices.

Cybersecurity Concerns in the Adoption of IoT Technology

This work explores the misuse of internationally sourced IoT products and how their cybersecurity incidents affect trade policy. The research explains how cybersecurity policy will affect trade, and identifies the best options for cybersecurity regulation within the international market.

Cybersecurity and International Trade

(IC)3 brings together thought leaders from industry, academia and government with MIT faculty, researchers and students to address strategy, management, governance and organization of cybersecurity for critical infrastructure.

(IC)3 Research Framework Overview

Smart city IoT is responsible for communicating system-critical data about urban infrastructure that keeps our modern cities functioning. Today, IoT devices lack commu- nication protocols with data integrity as a priority. Without data integrity, smart city infrastructure is at risk of actuating urban environments on compromised data. Attackers can use this IoT communication flaw to wage cyber-physical attacks on Smart Cities. We designed and developed an integrity-first communication protocol for IoT that is distributed and scalable based on the Ethereum blockchain. Our light client ensures data communication integrity for systems that require it most.

A Smart IoT Integrity – First Communication Protocol via an Ethereum Blockchain Light Client

Keeping the infrastructure of the country safe and secure is a non-negotiable need, but these same systems are constantly being targeted by cyber criminals’ intent on disrupting operations. Though the United States electricity grid is considered to be safeguarded and reliable, no system is impermeable. While the grid regularly faces system failures and effects of natural disasters one threat that the United States electricity sector has yet to face is a large-scale cyber-attack that has catastrophic consequences. This is good news. But at the same time, cyber-attacks on all industries are becoming more frequent and the threat to the energy sector is no different. In the first three months of 2018, there was a 32 percent increase in cyber- attacks on US industries from the previous year.[^1] Within the first six months of 2019, over 4 million data breaches occurred.[^2]
While all cyber-attacks are of concern, the unique concerns for the electricity sector lie in the potential for a large-scale attack where multiple utility companies are hit simultaneously, or an attack on a critical utility company where there are compounding effects on others that cause a domino-like impact across the sector. The result of either of these types of attacks would be a crisis for the impacted utility, but in addition, there would potentially prolonged outages or other damages since there might be insufficient resources available to assist in recovery and returning to normal operations.

Responding to a Large Scale Energy Delivery Sector Cyber Attack Case Study

With cyberattacks increasingly threatening businesses, executives need new tools, techniques, and approaches to protect their organizations. Unfortunately, criminal innovation often outpaces their defensive efforts. In April 2019, the AV-Test Institute, a research organization that focuses on IT security, registered more than 350,000 new malware samples per day, and according to Symantec’s 2019 Internet Security Threat Report, cyberattacks targeting supply chain vulnerabilities increased by 78% in 2018.1
Wide-scale attacks are becoming more common, too. In October 2016, a distributed denial-of-service (DDoS) attack that hit Dyn, a domain name system (DNS) provider, in turn brought down companies such as PayPal, Twitter, Reddit, Amazon, Netflix, and Spotify.2 In 2017, the WannaCry and NotPetya ransomware attacks affected health care, education, manufacturing, and other sectors around the world. A report from the Department of Health in the U.K. revealed that WannaCry cost it 92 million pounds.3 That same year, while the cyber-defense community was working out how to fight ransomware, cryptojacking — the hijacking of other people’s machines to mine cryptocurrency — arose as a threat. Cryptojacking attacks detected by Symantec increased by 8,500% during 2017.4 During 2018, the value of cryptocurrencies plunged 90%, yet Symantec still blocked four times as many cryptojacking attacks as the previous year.5

Casting the Dark Web In a New Light

The maturity model is a roadmap that highlights the way to increase organizational resilience to cyber-attacks.

Cybersecurity Culture Maturity Model

Stuart Madnick

Develop software that helps secure industrial control systems by leveraging our Ethereum light client to address industrial IoT security challenges.

Evaluating Effectiveness of an Embedded System Endpoint Security Technology on EDS: Defeating the Hackers of IIoT Devices

This project will identify the best available cybersecurity metrics in four key areas, and demonstrate how that information can best be packaged and presented to different entities, from the c-level, to the security team, to the stockholders.

Balanced Scorecard for Cybersecurity Management

Managers considering systems with AI engines must also understand the unique cybersecurity vulnerabilities. This project highlights the risks and suggests steps for ensuring these systems are trustworthy and reliable.

Cybersecurity of AI Systems

Companies do not want to do business with suppliers who might cause a cyber breach. Those who are able to show they are more secure than their competitors just might have a competitive advantage.