The constantly evolving cyber threat landscape is a latent problem for today’s companies. This is especially true for the Small and Medium-sized Enterprises (SMEs) because they have limited resources to face the threats but, as a group, represent an extensive payload for cybercriminals to exploit. Moreover, the traditional cybersecurity approach of protecting against known threats cannot withstand the rapidly evolving technologies and threats used by cybercriminals. This study claims that cyber resilience, a more holistic approach to cybersecurity, could help SMEs anticipate, detect, withstand, recover from and evolve after cyber incidents. However, to operationalize cyber resilience is not an easy task, and thus, the study presents a framework with a corresponding implementation order for SMEs that could help them implement cyber resilience practices. The framework is the result of using a variation of Design Science Research in which Grounded Theory was used to induce the most important actions required to implement cyber resilience and an iterative evaluation from experts to validate the actions and put them in a logical order. Therefore, this study proposes that the framework could benefit SME managers to understand cyber resilience, as well as help them start implementing it with concrete actions and an order dictated by the experience of experts. This could potentially ease cyber resilience implementation for SMEs by making them aware of what cyber resilience implies, which dimensions it includes and what actions can be implemented to increase their cyber resilience.

On the current environment, companies face risks and threats to the systems they need to operate often known as cyber threats. Most of these companies are small and medium-sized enterprises (SMEs) and they are exposed to these cyber threats. To mitigate the risks and be able to thrive with as little disruption as possible, SMEs require cyber resilience capabilities. However, due to their limited resources, SMEs usually have no dedicated personnel for cyber resilience operationalization and thus lack the experience this discipline requires to implement. To aid SMEs in their cyber resilience operationalization, the current literature offers several kinds of solutions, but these solutions are usually targeted for companies with more resources than SMEs and do not aid in the complete process of assessing their current cyber resilience, deciding actions to improve it and prioritizing these actions. To aid companies in this systematic process to operationalize or implement cyber resilience, this article develops and tests an operational web-based tool in which companies can follow the complete process described before. To achieve this, a cyber resilience framework with the essential policies for SMEs, descriptions of their natural progressions in a progression model and a prioritization of these policies have been developed. In this article, this framework, progression model and prioritization are later transformed into one cyber resilience self-assessment tool (CR-SAT) and are tested in three case studies to qualitatively evaluate the tool by trying to ascertain its usefulness and completeness as well as improving it with the feedback from the end-users.

The fourth industrial revolution has brought several risks to factories along with its plethora of benefits. The convergence of new technologies, legacy technologies, information technologies and operational technologies in the same network generates a wide attack surface. At the same time, factories need continuous production to meet their customers’ demand, so any stopped production can have harsh effects on a factory’s economy. This makes cyber resilience a key requirement in factories nowadays. However, it is difficult for managers to define effective cyber resilience strategies, especially considering the difficulty of estimating adequate investment in cyber resilience policies before the company has suffered cyber incidents. In this sense, the purpose of this article is to define and model an effective cyber resilience strategy. To achieve this, the system dynamics methodology was followed in order to get five experts’ opinions on the best strategy to invest in cyber resilience. Interviews were conducted with these experts; their reasoning was put into behavior over time graphs and a system dynamics model was built from these findings. The main conclusion is that a cyber resilience investment strategy should be dynamic, investing in both technical security and personnel training, but at first with an emphasis on technical security and later shifting to have an emphasis on training.

Due to the hazardous current cyber environment, cyber resilience is more necessary than ever. Companies are exposed to an often-ignored risk of suffering a cyber incident. This places cyber incidents as one of the main risks for companies in the past few years. On the other hand, the literature meant to aid on the operationalization of cyber resilience is mostly focused on listing the policies required to operationalize it, but is often lacking on how to prioritize these actions and how to strategize their implementation. Therefore, the usage of the current literature in this state is not optimal for companies. Thus, this study proposes a progression model to help companies strategize and prioritize cyber resilience policies by proposing the natural evolution of the policies over time. To develop the model, this study used semi-structured interviews and an analysis of the data obtained from the interviews. Through this methodology, this study found the starting points for each cyber resilience policy and their natural progression over time. These results can help companies in their cyber resilience building process by giving them insights on how to strategize the implementation of the cyber resilience policies.

Building an adequate level of cyber resilience to deal successfully with the daily threats in a company is a complex task. It requires several interconnected activities such as designing, implementing and maintaining a robust technical infrastructure, developing suitable formal procedures, and building a resilience culture among the employees.In the context of Small and Medium-sized Enterprises (SMEs), building cyber resilience could be more challenging because the resources are scarcer and thus the investments in this regard need to be well justified and accurate, or they could have a fatal effect on the company.This paper presents a simulation model that helps the managers of SMEs understand the need of developing cyber resilience in order to protect their companies. The model also shows the short and long-term effects of different strategies to build cyber resilience. The simulation model makes explicit the key factors to increase cyber resilience and their relationships to efficiently reduce organizational security breaches.

The Internet of Things (IoT) is a distributed system of physical objects that requires the integration of hardware (e.g., sensors, actuators) and network communications in order to collect and exchange data. IoT smart objects need to be identified in some way to determine the origin of the data. One of the best-positioned technologies to perform identification is RFID (Radio Frequency Identification), which has gained a lot of popularity in applications like access control, payment cards or logistics. This paper presents a RFID-based IoT Cybersecurity laboratory: it provides a guideline for understanding and analyzing in depth the RFID technology from the cybersecurity point of view. The application is based on Proxmark3, which is a suite of HW/SW tools that facilitates message eavesdropping and emulation of both tags and readers. All the software, firmware and hardware that is described here is open source and open design.