Trust Assessment in Cybersecurity Information Sharing Ecosystems: Trust Dimensions, Trust Processes, Trust Building Policies, and Trust Value Creation Model for Supporting Cybersecurity Information Sharing = 사이버 보안 정보 공유 생태계에서의 신뢰 평가: 사이버 보안 정보 공유를 지원하기 위한 신뢰 차원, 신뢰 프로세스, 신뢰 구축 정책, 그리고 신뢰 가치 창출 모델

다국어 초록 (Multilingual Abstract)

The widespread use of technology and digital platforms expanded cyberattacks to individuals, private enterprises, financial gain, and political activities. The entire digital environment people depend on must be safeguarded to prevent catastrophic interruptions or damage. Organizations, government agencies, security providers, and citizens must work together to create effective cybersecurity ecosystems, yet several organizations are still reluctant to share information. In addition, it has been discussed in academia and industry that trust is essential to cybersecurity ecosystems. Trust among stakeholders fosters collaboration, information sharing, technology confidence, privacy protection, and organizational resilience and reputation in the face of cyber threats. Trust also encourages transparency and collaboration, enabling cybersecurity knowledge sharing. Nevertheless, there is scarce literature that details what are the implications of trust in cybersecurity ecosystems. Through the development of a standalone systematic literature review methodology this research aims to understand current research and emerging cybersecurity ecosystem trust concerns, to illuminate trust and trust-building policies to exploit information sharing in the cybersecurity ecosystem, emerging concepts, the parameters that enable trust, the processes needed to boost trust, and the policies that support robust cybersecurity information sharing. Moreover, due to the fragility of trust amongst cybersecurity information ecosystem participants, it is vital to study how trust value is formed or how trust value characteristics affect other stakeholders' values. There is little scarce research on cybersecurity ecosystem trust value or usefulness. This study examines how trust factors affect cybersecurity ecosystem values by creating a novel model using system dynamics. The suggested trust evaluation model and algorithm are validated and verified after implementation. Different scenarios are tested to prove the strategy work. By studying how these metrics produce value in cybersecurity ecosystems, cybersecurity stakeholders may modify and improve ecosystem features to increase trust and information sharing ecosystems sustainability

국문 초록 (Abstract)

기술과 디지털 플랫폼의 광범위한 사용은 사이버 공격의 대상 범위를 개인, 민간 기업, 금전적 이익, 정치 활동 등으로 확대시켰습니다. 사람들이 의존하는 전체 디지털 환경은 치명적인 중단이나 피해를 방지하기 위해 반드시 보호되어야 합니다. 조직, 정부 기관, 보안 제공자, 시민들이 협력하여 효과적인 사이버 보안 생태계를 구축해야 하지만, 여전히 여러 조직들은 정보 공유에 소극적입니다.

또한 학계와 산업계에서는 신뢰가 사이버 보안 생태계에서 필수적이라는 점이 논의되어 왔습니다. 이해관계자 간의 신뢰는 협업, 정보 공유, 기술에 대한 신뢰, 개인정보 보호, 사이버 위협에 대한 조직의 회복력과 평판을 강화합니다. 신뢰는 또한 투명성과 협업을 촉진하여 사이버 보안 지식 공유를 가능하게 합니다. 그럼에도 불구하고, 사이버 보안 생태계에서 신뢰가 미치는 영향에 대해 구체적으로 다룬 문헌은 매우 부족합니다.

본 연구는 독립적인 체계적 문헌 고찰 방법론을 개발하여 현재의 연구 동향과 새롭게 대두되는 사이버 보안 생태계에서의 신뢰 이슈를 파악하고, 정보 공유를 극대화하기 위한 신뢰 및 신뢰 구축 정책, 새로운 개념, 신뢰를 가능하게 하는 요소, 신뢰를 증진시키기 위한 과정, 견고한 정보 공유를 뒷받침하는 정책 등을 조명하고자 합니다.

또한 사이버 보안 정보 생태계 참여자들 간의 신뢰가 매우 취약하다는 점에서, 신뢰 가치가 어떻게 형성되는지, 또는 신뢰 가치의 특성이 다른 이해관계자의 가치에 어떤 영향을 미치는지에 대한 연구가 중요합니다. 그러나 사이버 보안 생태계에서 신뢰 가치나 그 유용성에 대한 연구는 거의 없는 실정입니다.

이 연구는 시스템 다이내믹스를 활용하여 신뢰 요인이 사이버 보안 생태계의 가치에 어떻게 영향을 미치는지를 분석하고, 새로운 모델을 제시합니다. 제안된 신뢰 평가 모델과 알고리즘은 구현 후 검증 및 확인 과정을 거치며, 다양한 시나리오를 통해 그 전략의 효과를 입증합니다. 이러한 지표들이 사이버 보안 생태계 내에서 어떻게 가치를 창출하는지를 연구함으로써, 이해관계자들은 생태계의 특성을 조정하고 개선하여 신뢰와 정보 공유의 지속 가능성을 높일 수 있습니다

목차 (Table of Contents)

• Abstract I
• List of Figures XI
• List of Tables XVII
• List of Abbreviations XVIII
• 1. Chapter 1 Introduction 1
• 1.1 Research Background 1
• 1.2 Motivation 12
• 1.3 Research Problem Statement 15
• 1.4 Research Relevance 19
• 1.5 Research Objectives, Research Questions, and Hypotheses 23
• 1.6 Research Methodology 28
• 1.7 Research Contribution 33
• 1.8 Research Outline and Design 37
• 2. Chapter 2 State of the Art 40
• 2.1 Cyberattacks Costs 40
• 2.2 Cybersecurity Efforts 46
• 2.3 Cybersecurity Ecosystems 50
• 2.4 Stakeholders in cybersecurity information sharing ecosystems. 51
• 2.4.1 Cybersecurity Service Provider 51
• 2.4.2 Insurance Provider 52
• 2.4.3 Cybersecurity Groups 53
• 2.4.4 Cybersecurity Administrators 54
• 2.4.5 Government 55
• 2.4.6 End Users 56
• 2.4.7 Cybersecurity Data Source Provider 57
• 2.4.8 Cybersecurity Information Producers 58
• 2.4.9 Standardization Organization 59
• 2.5 Trust role in Cybersecurity Efforts 59
• 2.6 Trust Overview in Cybersecurity Information Sharing Ecosystem 61
• 2.6.1 Trust between Stakeholders to Platform 63
• 2.6.2 Trust between Stakeholders 63
• 2.6.3 Trust between Stakeholders to Cybersecurity Information 64
• 3. Chapter 3 Trust and Trust-Building Policies to Support Cybersecurity Information Sharing: A Systematic Literature Review 66
• 3.1 Introduction 66
• 3.1.1 Background 67
• 3.1.2 Research Problem 68
• 3.1.3 Research Objectives and Research Questions 71
• 3.1.4 Contribution of the Research 74
• 3.1.5 Outline of the rest of this chapter 76
• 3.2 State of the art 77
• 3.2.1 Role of Trust in Cybersecurity 77
• 3.2.2 Focus of the Research 79
• 3.3 Methodology 95
• 3.3.1 Defining Keywords 96
• 3.3.2 Customize Search Queries 97
• 3.3.3 Inclusion and Exclusion criteria 98
• 3.3.4 Quality appraisal 100
• 3.3.5 Data Extraction 101
• 3.3.6 Analysis and Synthesis 102
• 3.4 Analysis of Results 105
• 3.4.1 Descriptive Analysis 106
• 3.4.2 Trust dimensions in cybersecurity information sharing ecosystems. 110
• 3.4.3 Processes to increase trust in cybersecurity ecosystems. 132
• 3.4.4 Trust and Sharing Policies in Cybersecurity 151
• 3.5 Discussion 195
• 3.5.1 Summary of Findings 195
• 3.5.2 Relationship between trust dimensions, trust processes and trust policies. 204
• 3.5.3 Proposed Framework to boost Information Sharing 209
• 3.5.4 Opportunities and Challenges 216
• 3.5.5 Implications 221
• 3.6 Conclusion 228
• 3.6.1 Summary 228
• 3.6.2 Limitations and Future Research 234
• 4. Chapter 4 Trust Parameters Impact on Stakeholders’ Value Model in Cyber Security Information Sharing Ecosystem 237
• 4.1 Introduction 237
• 4.1.1 Background 238
• 4.1.2 Research Problem 239
• 4.1.3 Relevancy 241
• 4.1.4 Research Objective and Research Hypothesis 244
• 4.1.5 Contribution of the Research 246
• 4.1.6 Outline of the Paper 248
• 4.2 State of the art 249
• 4.2.1 Trust Overview in Cybersecurity Information Sharing Ecosystem 249
• 4.2.2 Focus of research 256
• 4.3 Methodology 283
• 4.3.1 System Dynamics 283
• 4.3.2 Proposed Trust Structure Model for Value Creation in Cyber Security Information Sharing Ecosystems 285
• 4.3.3 Development of Stakeholders’ Utility Equations 313
• 4.3.4 Simulation Description of Trust Model for Cyber Security Information Sharing Ecosystems 337
• 4.3.5 Simulation Reference Scenarios Description 346
• 4.4 Simulation Analysis Results 356
• 4.4.1 Analysis of stakeholders’ values for reference scenarios 356
• 4.4.2 Trust of stakeholders to platform (TSP) analysis results 371
• 4.4.3 Trust of stakeholders to platform (TBS) analysis results 396
• 4.4.4 Trust of stakeholders to information (TSI) analysis results 422
• 4.4.5 Trust to policy compliance (TPC) analysis results 448
• 4.5 Sensitivity Analysis 474
• 4.5.1 Cybersecurity Service Provider (CSP) vs End User (USR) sensitivity analysis (cost experienced by CSP and fee paid by USR) 475
• 4.5.2 Cybersecurity Information Producer (CIP) vs End User (USR) sensitivity analysis (cost experienced by CIP and fee paid by USR) 480
• 4.6 Discussion 484
• 4.6.1 Summary of findings 485
• 4.6.2 Opportunities and challenges 498
• 4.6.3 Implications 503
• 4.7 Conclusion 508
• 4.7.1 Summary 508
• 4.7.2 Strategies 512
• 4.7.3 Limitations and future research 513
• 5. Chapter 5 Conclusion 515
• 5.1 Summary 516
• 5.2 Implications 520
• 5.2.1 Implications for platform service providers 520
• 5.2.2 Implications for end users 521
• 5.2.3 Implications for information producers 522
• 5.2.4 Implications for governance 523
• 5.2.5 Implications for policy makers 523
• 5.3 Limitations and Future research 524
• Bibliography 528
• Acknowledgments 560
• Abstract (Korean) 561