Bridging Networks, Systems and Controls Frameworks for Cybersecurity Curricula & Standards Development

Abstract

Applied Cybersecurity practices in the US private and public industry are transitioning to an overall focus on Cyber Risk Management. It is hence necessary to align IT-Cybersecurity professional association application standards and related educational curricula with emerging applications in practice. Current standards and educational curricula seem fragmented across Networks Protocols and Network Analysis Tools Frameworks, Systems and Networks Infrastructure Frameworks, and, Risk Management & Controls Policy Frameworks. This article develops an applied framework for aligning, integrating, and, streamlining standards and curricula across the above three levels to align them with needs of applied Risk Management practice. The Cyber Risk Management framework is developed with focus on VoIP networks which have been gaining central prominence across diverse industries such as global Banking and Finance over the past decade. Despite central role technologically and economically, sparse attention has been given to critical vulnerabilities described as the ‘weakest links’ in global Banking and Finance networks as evident from Cybersecurity and Penetration Testing. This article demonstrates the contribution of the proposed Cyber Risk Management framework in addressing such critical gaps in global Banking and Finance Cybersecurity and Information Assurance practices as an example while being extendable to multiple other industries such as Healthcare.

Related Conference Presentation: Toward Integrated Enterprise Risk Management, Model Risk Management & Cyber-Finance Risk Management: Bridging Networks, Systems and Controls Frameworks. Presented at: 2015 NY Cyber Security & Engineering Technology Association Conference, Oct. 22, 2015, Rochester Institute of Technology, Rosica Hall, NTID, Rochester, New York (http://ssrn.com/abstract=2792629).

Keywords: Cyber Risk Management, Cybersecurity and Penetration Testing, Computer Science Curricula, Professional Standards of Practice, Networks Protocols and Network Analysis, Systems and Networks Infrastructure, Risk Management & Controls Policy, STEM Education Developments