Cyber Operations: Security Frameworks, Legal and Ethical Issues

This report provides an overview of cyber operations, emphasizing the importance of cybersecurity in today's digital landscape. It delves into various tools and techniques used to protect data and infrastructure from cyber attacks, including firewalls, antivirus software, PKI services, managed detection services, penetration testing, and staff training. The report also examines cyber-security frameworks, legal and regulatory frameworks, compliance and enforcement frameworks, capacity building, cyber secure acculturation frameworks, and business development frameworks. Furthermore, it addresses the ethical and social implications of cyber operations, as well as relevant legal standards and practices. The document highlights the need for continuous improvement and adaptation in cybersecurity strategies to combat evolving threats, offering insights into risk assessment, emergency response, and the implementation of information security management systems (ISMS).

Running head: CYBER OPERATION
Cyber Operation
Name of the Student
Name of the University
Author Note:

1CYBER OPERATION
Abstract
In the last few years, Cyber Security has gained huge amount of importance and has become a
common part of everyone’s life. When people provide their data through online mode, then they
become vulnerable to both cyber attacks or even cybercrimes. Cyber attacks can easily take place
on any DNS server or even internal firewall. It can turn down data and required infrastructure
within the given enterprise which can cause significant to the business of the given organization.
Cyber Security aims to offer proper security from any kind of authorized access or exploitation.
It tends to provide online services to the given data that is associated with the appliance and
network needed for communication. The overall life cycle of cybersecurity can be classified into
different stages. In the coming pages of the report, the latest technologies and techniques have
been discussed in details. A list of justification has been provided with respect to selection of
particular tools and equipments. Various issues have been discussed with respect to installation
and configuration has been discussed in details. The last section of the report deals with social or
ethical issues and standard or legal issues. Ransomware is a well-known cyber-security that tends
to affect the system and backup devices.

2CYBER OPERATION
Table of Contents
Introduction..........................................................................................................................3
Literature review..................................................................................................................4
Tools and Techniques......................................................................................................4
Cyber –Security Framework............................................................................................5
Legal and Regulatory Framework...............................................................................7
Compliance and Enforcement Framework..................................................................8
Capacity building and Cyber Secure acculturation framework.................................10
Business Development Framework...........................................................................12
Conclusion.........................................................................................................................13
References..........................................................................................................................15

3CYBER OPERATION
Introduction
Cyber Security is nothing but a complex issue that cuts across various domains. It mainly
cuts up for multi-layer initiatives and multi-layer dimension. It aims to create challenges for
various government which is just because of various domain. It is mainly administered through
ministries and domain (Bada, Sasse and Nurse 2019). Overall development of Information
technology and its ease of application can be easily commercialized due to expansion of
cyberspace. Cybersecurity is all about protecting the required information and the given devices
from any kind of threat. It has ultimately become a part of the organization that collects and
maintains huge database for the information of customer. Apart from this, it aims to provide
social platform where required personal, as well as government information, is submitted. It
helps in describing the fact that how personal and key government information data are protected
from any kind of vulnerable attacks (Anwar et al. 2017). It can possess huge amount of threat to
information. The given information can be stored on either cloud, network, devices, and other
application. There is a need for huge amount of capital information in protecting the information
on online platform. With each passing day, the number of number of users are increasing so as a
result, the threat to information is also increasing.
The coming pages of the report a literature review has been done with cybersecurity
policies. After that, a list of technologies and techniques with respect to cybersecurity has been
discussed in details. A list of justification has been provided with respect to selection of proper
equipment and tools. A list of issues with respect to configuration and implementation has been
provided in details.

4CYBER OPERATION
Literature review
Tools and Techniques
According to (Gupta, Agrawal and Yamaguchi, 2016), there are six tools and services
which is required by various business. It mainly tends to highlight the need for overall
cybersecurity that requires to be strong as much as possible.
Firewall: With the passage of time, cybercriminals have become stronger and have a
much stronger defense. Firewall is well-known network traffic along with a connection attempts
that helps in deciding whether the traffic should freely pass the network or not (Safa, Von Solms
and Furnell 2016). There are some skilled hackers who come up with ability to create data and
programs which can even trick the firewall. They mainly assure the firewall the fact that
programs are trusted so that they can pass the firewalls with any issue. Irrespective of the
limitation, firewalls are very much effective in analyzing malicious attacks on the business.
Anti-virus Software: Antivirus Software helps in altering with respect to any kind of
virus and malware infection. It aims to provide any kind of additional information with respect to
scanning of email so they can ensure they are free from any kind of malicious attack (Carr,
2016). The present antivirus programs are considered to be very much useful for protecting
various measures like understanding potential threats along with removing them. There is large
number of antivirus software which helps in finding out the package as per the business needs.
PKI Services: There is large number of people who are associated PKI with two kinds of
things like SSL or TSL based technology. It mainly helps in encrypting server-based technology
which is totally responsible for HTTPS (Safa, Von Solms and Futcher 2016). PKI is essential in

5CYBER OPERATION
solving a large number of cybersecurity issues and they tend to deserve a proper place in
organization suite.
Managed Detection of Services: With the passing time, cybercriminals tend to become
very sophisticated as they are using technology and software which are advanced. So, it has
become important for business to invest in more powerful mode of defense (Carrapico and
Barrinha, 2017). Cybersecurity tends to look for technologies that can prevent the possibility of
any kind of attack. It tends to provides huge number of services which can react and react to any
kind of potential issues.
Penetration Testing: This particular testing is considered to be vital point for securing
business systems. At the time of penetration testing, there is large number of cybersecurity
professionals which makes use of techniques similar to potential vulnerabilities along with areas
of weakness (Khalili, Naghizadeh and Liu 2018). A pen test focus on attempting similar kind of
attack which is faced by business due to criminal hackers. It is mainly inclusive of various things
like password cracking and injection of code.
Staff training: Employees aims to understand the role of cybersecurity which is one of
the strongest forms to provide defense against the attacks. At present, there is large number of
training tools in which organization can invest to provide education to staff about cyber security
(Fowler et al. 2017). With the passage of time, cyber-criminals tend to expand their method of
attack so that business can make investment on the given tools and services.
Cyber –Security Framework

6CYBER OPERATION
Cyber-Security Framework aims to put hold on another kind of framework that is focused
to provide solution for cyber-security threat (Romanosky et al. 2017). There are mainly four
pillars under this particular framework like
Fig 1: Framework of Cyber-Security Policy Framework
(Source: Created by Author)

7CYBER OPERATION
Legal and Regulatory Framework
Cyberlaw and Related Legislation
The main notion of this particular framework is all about addressing specific legislation
which governs the cyberspace (Romanosky et al. 2017). It is done by various kind of
collaborative initiatives. Various government bodies have collaborated with NALSAR in the
domain of security. There is some existing framework which can identify the problem and form
proper laws for tackling real-time issues that are faced by entities (Saini et al. 2018). The
collaborative effort which is required for understanding the corner of every evolving threat.
There is some non-cyber specific legislation that is specific to cyberspace activity. It is used for
protection of various aspects like copyright, defamation and national security. It is needed for
addressing and protecting information which will help in flow of information on the internet.
Cybercrime Cells
There are different kind of government bodies that are specialized for cybercrime cell
into proper complaints. It can penetrate to offense under the given information technology Act.
Government has fully strengthened the simplify reporting and tracking process of cyber-crimes
(Xu 2015). Different government bodies around the globe have come proper plan for tackling
cyber-bullying. The cybercrime will focus on the crimes that are taking place at present.
Cyber Forensic
Various government bodies have come up with plan of investigating and analyzing any
kind of cybercrimes. It will ultimately help in recovery and preserving the overall digital
presence. In the coming years, there will be data recovery plan to recover data which have may

8CYBER OPERATION
become corrupted (Liu et al. 2015). This might become as a result of any kind of cybercrime.
With respect to building efforts, there is a need for data experts that can handle forensic and
related requirements. By the help of digital evidence, there is a need for preservation facility that
aims to create secure environment for retaining digital evidence.
Compliance and Enforcement Framework
Protection of CII
Absolute security can be considered as a mere concept only but it cannot be achieved
practically irrespective of resources that are invested. By the help of risk-based approach, a
proper priority is given on the risk. In the coming years, government aims to come up with
information protection plan which is in collaboration with private sector (Knowles et al. 2015). It
can be carried out by the help of risk-based analysis approach. Proper facilitating of cooperation
and collaboration against the given security threats can be achieved at the highest level (Fowler
et al. 2017). The government aims to comes up with proper policies and procedures which is
needed for policy and decision and inputs.
Emergency Response
Government bodies have come up with T-CERT which is a nodal agency for
coordinating with various institutes and organization. T-CERT aims to contribute to safety zone
which is all about providing much safer and stronger internet based connection (Spear, 2015). It
can be achieved by responding to threats and exchange of cybersecurity information with the
partners. The main highlighting points of T-CERT are

9CYBER OPERATION
 Providing cybersecurity action to government, agencies, private industries and general
public by the help of advisories.
 Providing protection of cybersecurity protection by the help of intrusion detection and
capabilities for prevention (Khalili, Naghizadeh and Liu 2018).
 Increasing overall security measures so that they increase awareness of information
security along with understanding the computer security issues.
Standard and Practices
By the help of partnership of private players, government can create proper infrastructure.
It aims to set up information sharing and analysis center for providing proper actionable
information (Bagheri et al. 2016). It is all about analyzing trends by which they can find out
threats and opportunities. It is mainly inclusive of large number of points like
 Development and implementation of proper information security standard
 Development of information security guidelines along with understanding proper
practices.
ISMS Implementation
Government bodies need to encourage the overall adaptation of ISMS in various
organization around the globe. Apart from this, government bodies need to understand the
potential of having ISMS initiative that will call both small and medium scale organization
(Gove 2016). It will ultimately focus on practical governance and issues in different system
taking account of business and challenges associated with it. It might not address the technical
problem associated with it.

10CYBER OPERATION
ICT Security Certification
Government bodies aim to create ICT security assessment facility where there can be
product certificate compliance (Alotaibi, Furnell and Clarke 2016). It is mainly done for various
sensitive products of ICT which is linked both directly and indirectly. Facilities will be provided
to another kind of services also like:
 Both penetration testing and vulnerability testing can be done for the security assessment
for given control system.
 ICT product security and required certification of services.
 Evaluation of common criteria.
Common criteria for given information technology as known as common criteria model is
a well-known standard for security certification of computer. Common criteria are used by
government-driven certification and product testing and evaluation. It will be mainly conducted
through government agencies and critical infrastructure (Tsigkanos et al. 2018). Various
government bodies are also focusing on to introduce any kind of security kite-marks that will
help both individual and organization in identifying security products. In the coming days,
certification of both cybersecurity products and ICT products will be considered to be
mandatory.
Capacity building and Cyber Secure acculturation framework
Information Security Workforce Capacity Building
Different government bodies need to encourage, develop training programs so that they
can increase cyber-security awareness among the organization. Government aims to play a key

11CYBER OPERATION
role in forensic and provide cybersecurity-related services. It will ultimately create tool which
will help cyber-security experts so that they can provide proper services. Government bodies
need to develop proper certification by collaboration with various academic institutes. It is
mainly done so that they can encourage students to sign up for the programs (Thuraisingham et
al. 2016). TASK aims to provide different kind of assistance for recruitment to private sectors
that will ultimately reduce on-boarding cost for employers. Apart from this, various government
bodies have come up center of excellence which is in association with college for higher degree.
It is mainly done so that they can boost research in various domain of cyber-security.
Government plans to launch some particular R&D projects which is much similar to challenges
that are faced by government (Carrapico and Barrinha, 2017). It also needs to address the given
centers. In the upcoming years, there is a need for a pool of ‘cyber warriors’ that are trained in
cyber security which will work as part-time security consultant.
Cyber Security Acculturation
In the upcoming years, the state expects to launch a multi-wide channel awareness
campaign that requires involvement of digital media and social. It mainly focuses on creating
cyber-security awareness among people. Cyber-security will play a key role in understanding
digital education (Toch et al. 2018). Government bodies are planning to modify the schools due
to cyber-security for the children. The program can be deployed along with school literacy. Apart
from this, government is planning to launch a program which is accessible to children to deal
with issues like privacy and theft. With the passage of time, number of human interaction is
being shifted to online mode. There is an importance of good and acceptable behavior which will
be outlined to behavior mode (Safa, Von Solms and Futcher 2016). By the help of collaboration

12CYBER OPERATION
with private sectors, government bodies will provide some guidelines which will help citizen and
organization to be aware of developments in cybercrimes along with addressing them.
Government bodies are planning to provide an annual competition named as Cyber-
Security Challenge that will identify and help in identifying new talents. The main focus on the
government bodies is all about building assurance in the community (Soomro, Shah and Ahmed
2016). It is all about understanding government initiatives and cyberspace which will help the
stakeholders. The challenge will be at different levels that will provide cyber-security skills and
competencies.
Business Development Framework
Promoting Local Cyber Security Industry
Government bodies have come up with T-Hub with a vision for boosting the ecosystem
in various state. Under this vision, there is a need for cyber-security with respect to startups.
Government bodies will provide capital model that will provide assistance for the startup
organizations (Dunn Cavelty, Kaufmann and Søby Kristensen 2015). In addition, the state will
have Annual Cyber Security expo that will provide advantages to the present. It aims to develop
products which can be used by both SME and Startup. It will also ensure the fact that cyber-
security can interact and discuss with upcoming development in different regions of the globe
(Carr, 2016). Government aims to provide various kind of cyber-security in each of the passing
years to SME. It aims to ensure transparency in the allotment methods.
Strategic Partnership

13CYBER OPERATION
Government bodies are planning to incorporate R&D projects in various regions of state.
Many startups are planning to provide access to government application that will provide proof
of concept. The given project will be changed into full-scale government contracts which is post
review (Newhouse et al. 2017). For providing safety at supply end, government bodies need to
provide ISP which will provide individual access to the present security that will provide
security. For tackling any kind of fraudulent activity, government needs to provide identity
assurance and another kind of measures. In the near future, government bodies are planning to
enter into strategic partnership in private sector so that they can set up infrastructure like training
for cyber-security (Safa, Von Solms and Furnell 2016). It will ultimately provide facilities for
development of new and upcoming products.
Stakeholder Responsibility
There is mainly two kinds of stakeholders involved like citizen and private sector which
will provide huge number of opportunities to government bodies. It will ultimately aim to
provide safe vision for cyber-space (Bada, Sasse and Nurse 2019). Cyber-space consists of
network where chain is the only strongest one. There is a demand for various entity to
understand the basic responsibilities for providing security to cyber-threats.
Conclusion
From the above pages, the point can be considered that this report is all about cyber-
security policies. Information is considered to be an important part of any organization which is
investing in right service providers. It is mainly needed for keeping the whole business in safe
hands in the growing world of IoT (Internet of things). Scalable and customized cyber-security
business model is mainly inclusive of disaster recovery capabilities. It aims to secure data and

14CYBER OPERATION
underlying infrastructure of the organization. It will build a much safe barrier for the information
prior to attack and saves the organization from loss of billions of dollars. It will ultimately result
in huge amount of security threat to organization. Technology is considered to be great enabled
for various states that can propel it to greater heights of achievement and prominences among the
other states of the nation. It is expected that it will provide much greater foundation and talent in
whole IT where it can emerge as a leading state. Government aims to believe that growth can be
managed so that it can be nurtured and sustained. Government plans to provide cyber-security
policy which can address the challenges due to technology and cyberspace. Both national and
international bodies are advancing at a rapid rate so that it can easily establish itself as digital
state. Cyberworld is a world that has no boundaries and comes up with huge number of
opportunities. For securing digital environment, a proper effort is given by government bodies to
incorporate institutes and citizen. Various nation around the globe are planning to establish itself
as global leader in the domain of cybersecurity`

15CYBER OPERATION
References
Alotaibi, M., Furnell, S. and Clarke, N., 2016, December. Information security policies: a review
of challenges and influencing factors. In 2016 11th International Conference for Internet
Technology and Secured Transactions (ICITST) (pp. 352-358). IEEE.
Anwar, M., He, W., Ash, I., Yuan, X., Li, L. and Xu, L., 2017. Gender difference and employees'
cybersecurity behaviors. Computers in Human Behavior, 69, pp.437-443.
Bada, M., Sasse, A.M. and Nurse, J.R., 2019. Cyber security awareness campaigns: Why do they
fail to change behaviour?. arXiv preprint arXiv:1901.02672.
Bagheri, H., Sadeghi, A., Jabbarvand, R. and Malek, S., 2016, June. Practical, formal synthesis
and automatic enforcement of security policies for android. In 2016 46th Annual IEEE/IFIP
International Conference on Dependable Systems and Networks (DSN) (pp. 514-525). IEEE.
Carr, M., 2016. Public–private partnerships in national cyber-security strategies. International
Affairs, 92(1), pp.43-62.
Carrapico, H. and Barrinha, A., 2017. The EU as a coherent (cyber) security actor?. JCMS:
Journal of Common Market Studies, 55(6), pp.1254-1272.
Dunn Cavelty, M., Kaufmann, M. and Søby Kristensen, K., 2015. Resilience and (in) security:
Practices, subjects, temporalities. Security Dialogue, 46(1), pp.3-14.
Fowler, S., Sweetman, C., Ravindran, S., Joiner, K.F. and Sitnikova, E., 2017. Developing
cyber-security policies that penetrate Australian defence acquisitions. Australian Defence Force
Journal, (202), p.17.

16CYBER OPERATION
Gove, R., 2016, October. V3SPA: A visual analysis, exploration, and diffing tool for SELinux
and SEAndroid security policies. In 2016 IEEE Symposium on Visualization for Cyber Security
(VizSec) (pp. 1-8). IEEE.
Gupta, B., Agrawal, D.P. and Yamaguchi, S. eds., 2016. Handbook of research on modern
cryptographic solutions for computer and cyber security. IGI global.
Khalili, M.M., Naghizadeh, P. and Liu, M., 2018. Designing cyber insurance policies: The role
of pre-screening and security interdependence. IEEE Transactions on Information Forensics and
Security, 13(9), pp.2226-2239.
Knowles, W., Prince, D., Hutchison, D., Disso, J.F.P. and Jones, K., 2015. A survey of cyber
security management in industrial control systems. International journal of critical
infrastructure protection, 9, pp.52-80.
Liu, Y., Sarabi, A., Zhang, J., Naghizadeh, P., Karir, M., Bailey, M. and Liu, M., 2015. Cloudy
with a chance of breach: Forecasting cyber security incidents. In 24th {USENIX} Security
Symposium ({USENIX} Security 15) (pp. 1009-1024).
Newhouse, W., Keith, S., Scribner, B. and Witte, G., 2017. National initiative for cybersecurity
education (NICE) cybersecurity workforce framework. NIST Special Publication, 800, p.181.
Romanosky, S., Ablon, L., Kuehn, A. and Jones, T., 2017. Content analysis of cyber insurance
policies: How do carriers write policies and price cyber risk?.
Safa, N.S., Von Solms, R. and Furnell, S., 2016. Information security policy compliance model
in organizations. Computers & Security, 56, pp.70-82.

17CYBER OPERATION
Safa, N.S., Von Solms, R. and Futcher, L., 2016. Human aspects of information security in
organisations. Computer Fraud & Security, 2016(2), pp.15-18.
Saini, S., Beniwal, R.K., Kumar, R., Paul, R. and Saini, S., 2018. Modelling for improved cyber
security in Smart distribution system. International Journal on Future Revolution in Computer
Science & Communication Engineering, Accepted.
Soomro, Z.A., Shah, M.H. and Ahmed, J., 2016. Information security management needs more
holistic approach: A literature review. International Journal of Information Management, 36(2),
pp.215-225.
Spear, M., 2015. Industrial Cyber Security 101. Honeywell Users Group Europe, Middle East
and Africa.
Thuraisingham, B., Kantarcioglu, M., Hamlen, K., Khan, L., Finin, T., Joshi, A., Oates, T. and
Bertino, E., 2016, July. A data driven approach for the science of cyber security: Challenges and
directions. In 2016 IEEE 17th International Conference on Information Reuse and Integration
(IRI) (pp. 1-10). IEEE.
Toch, E., Bettini, C., Shmueli, E., Radaelli, L., Lanzi, A., Riboni, D. and Lepri, B., 2018. The
privacy implications of cyber security systems: A technological survey. ACM Computing
Surveys (CSUR), 51(2), p.36.
Tsigkanos, C., Pasquale, L., Ghezzi, C. and Nuseibeh, B., 2018. On the interplay between cyber
and physical spaces for adaptive security. IEEE Transactions on Dependable and Secure
Computing, 15(3), pp.466-480.
Xu, S., 2015. Cybersecurity dynamics. arXiv preprint arXiv:1502.05100.