Increasing digitisation in the maritime domain and the intensive use of information technologies have become essential for the effective functioning of systems that manage navigation, communications, sensors and weapons throughout the maritime chain. In this context, the issuance and enforcement of international standards and policies are seeking to mitigate the appearance of threats and vulnerabilities that aim to compromise access to functionalities, on-board systems and network integrity. Thus, in this article, we first review the main proposals for guidelines, frameworks and other solutions related to cybersecurity in the maritime environment. Subsequently, we analyse the way in which cybersecurity challenges specific to systems and equipment in this particular environment are addressed, identifying the main cybersecurity weaknesses and needs in the maritime environment that are not completely addressed. Based on this analysis, we then propose the structure of POSEIDON, a comprehensive framework for managing cybersecurity in maritime environments that addresses the identified gaps. This cybersecurity management framework takes into account existing proposals and is complemented by a set of new elements to provide a comprehensive approach to addressing the weaknesses identified.

The Information Security Management Systems (ISMS) are global and risk-driven processes that allow companies to develop their cybersecurity strategy by defining security policies, valuable assets, controls, and technologies for protecting their systems and information from threats and vulnerabilities. Despite the implementation of such management infrastructures, incidents or security breaches happen. Each incident has associated a level of severity and a set of mitigation controls, so in order to restore the ISMS, the appropriate set of controls to mitigate their damage must be selected. The time in which the ISMS is restored is a critical aspect. In this sense, classic solutions are efficient in resolving scenarios with a moderate number of incidents in a reasonable time, but the response time increases exponentially as the number of incidents increases. This makes classical solutions unsuitable for real scenarios in which a large number of incidents are handled and even less appropriate for scenarios in which security management is offered as a service to several companies. This paper proposes a solution to the incident response problem that acts in a minimal amount of time for real scenarios in which a large number of incidents are handled. It applies quantum computing, as a novel approach that is being successfully applied to real problems, which allows us to obtain solutions in a constant time regardless of the number of incidents handled. To validate the applicability and efficiency of our proposal, it has been applied to real cases using our framework (MARISMA).

The information society is increasingly more dependent on Information Security Management Systems (ISMSs), and the availability of these kinds of systems is now vital for the development of Small and Medium-Sized Enterprises (SMEs). However, these companies require ISMSs that have been adapted to their special features, and which are optimized as regards the resources needed to deploy and maintain them. This article shows how important the security culture within ISMSs is for SMEs, and how the concept of security culture has been introduced into a security management methodology (MARISMA is a Methodology for “Information Security Management System in SMEs” developed by the Sicaman Nuevas Tecnologías Company, Research Group GSyA and Alarcos of the University of Castilla-La Mancha.) for SMEs. This model is currently being directly applied to real cases, thus allowing a steady improvement to be made to its implementation.

The increasing digitisation of Government services poses critical challenges in cybersecurity. Existing security frameworks, despite their proliferation, often fail to effectively integrate interoperability and secure data exchange, nor do they present adaptive risk management, or strategic cybersecurity governance, exposing sensitive information and critical infrastructures to escalating cyber threats. This research addresses this gap by proposing the GAUCHO (Government adaptive unified cybersecurity holistic orchestration) framework, a holistic model that integrates an adaptive risk management methodology based on MARISMA, an interoperability scheme for secure data exchange based on X-Road, and a strategic cybersecurity governance component. The proposal, resulting from a systematic literature review, aims to offer a comprehensive solution for the protection of e-Governments, with a focus on the citizen, sustainability, and regulatory compliance. The GAUCHO framework is presented as a solution with which it seeks to safeguard digital Government environments.

The concept of competence, which emerged during the reform of computer engineering degrees, has not brought benefits to companies when attempting to select the most suitable candidates for their jobs. This article aims to show some of the research that has been conducted to determine why companies have not found these skills useful and how both can be aligned. Finally, we show the development of an Expert System that will enable companies to select the most suitable candidates for their jobs, considering personal and social skills, along with technical knowledge. This prototype will serve as a basis to align the competencies defined in the curricula with professional requirements, thus allowing a true alignment between degree courses and the needs of professional companies.