TIM-8715 v1

Anees, A., & Hussain, I. (2019). A novel method to identify initial values of chaotic maps in cybersecurity. Symmetry (20738994), 11(2), 140.
This paper shows the application of chaos theory to communication security systems and cryptography-related algorithms. The authors propose an analysis of the framework by the research community and make a call for future research to obtain and assess the long-term chaotic sequence from cryptosystems.

Raddatz, N. I., Marett, K., & Trinkle, B. S. (2020). The impact of awareness of being monitored on computer usage policy compliance: An agency view. Journal of Information Systems, 34(1), 135–149.
This journal article explores the need for organizations to understand the factors that motivate employees to follow computer usage policies. The authors investigate the impact of different countermeasures, such as perceived sanctions, and awareness of being monitored on compliance with computer usage policies by drawing upon agency theory and general deterrence theory.

Onumo, A., Ullah-Awan, I., & Cullen, A. (2021). Assessing the moderating effect of security technologies on employees compliance with cybersecurity control procedures. ACM Transactions on Management Information Systems (TMIS), 12(2), 1–29.
This journal article draws insight from organizational theory literature, and the authors develop a multi-theory model, combining the elements of the theory of planned behavior, the competing value framework, and technology (organizational and environmental theory) to examine how the organizational mechanisms interact with espoused cultural values and employee cognitive belief to influence cybersecurity control procedures.

Rios Insua, D., Couce, V. A., Rubio, J. A., Pieters, W., Labunets, K., & G. Rasines, D. (2021). An adversarial risk analysis framework for cybersecurity. Risk Analysis: An International Journal, 41(1), 16–36.
In this journal article, the authors propose a comprehensive framework for cybersecurity risk analysis, covering the presence of both intentional and unintentional threats and the use of insurance as part of the security portfolio. A simplified case study illustrates the proposed framework, serving as a template for more complex problems.

National Institute of Standards and Technology (NIST). (n.d.). NIST cybersecurity framework. National Institute of Standards and Technology (NIST).
The NIST Cybersecurity Framework consists of standards, guidelines, and best practices to manage cybersecurity risk for organizations.

National Institute of Standards and Technology (NIST). (n.d.). NIST risk management framework (RMF). National Institute of Standards and Technology (NIST).
The NIST Risk Management Framework (RMF) provides a comprehensive, flexible, repeatable, and measurable 7-step process that any organization can use to manage information security and privacy risk for organizations and systems and links to a suite of NIST standards and guidelines to support the implementation of risk management programs to meet the requirements of the Federal Information Security Modernization Act (FISMA).

Center for Internet Security (n.d.). The 18 CIS critical security controls. CIS.
The 18 CIS critical security controls list is a valuable resource of tools for the cybersecurity practitioner and researcher.

MITRE Corporation. (n.d.). MITRE ATT&CK framework. MITRE Corporation.
MITRE ATT&CK® is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.

IT Governance (n.d.). The ISO 27002 Standard. IT Governance.
The ISO 27002 Standard is a code of practice for information security controls.

Quinn, S., Ivy, N., Barrett, M., Witte, G., & Gardner, R.(2022). Integrating cybersecurity and enterprise risk management (ERM) (NISTIR 8286). National Institute of Standards and Technology (NIST).
This document is designed as a framework to assist individual organizations within an enterprise to improve their cybersecurity risk information, which they provide as inputs to their enterprise’s ERM processes through communications and risk information sharing. Section 2 focuses on various frameworks and models used to identify and understand risk in the enterprise.