When all computers shut down: the clinical impact of a major cyber-attack on a general hospital.

Importance: Healthcare organizations operate in a data-rich environment and depend on digital computerized systems; thus, they may be exposed to cyber threats. Indeed, one of the most vulnerable sectors to hacks and malware is healthcare. However, the impact of cyberattacks on healthcare organizations remains under-investigated. Objective: This study aims to describe a major attack on an entire medical center that resulted in a complete shutdown of all computer systems and to identify the critical actions required to resume regular operations. Setting: This study was conducted on a public, general, and acute care referral university teaching hospital. Methods: We report the different recovery measures on various hospital clinical activities and their impact on clinical work. Results: The system malfunction of hospital computers did not reduce the number of heart catheterizations, births, or outpatient clinic visits. However, a sharp drop in surgical activities, emergency room visits, and total hospital occupancy was observed immediately and during the first postattack week. A gradual increase in all clinical activities was detected starting in the second week after the attack, with a significant increase of 30% associated with the restoration of the electronic medical records (EMR) and laboratory module and a 50% increase associated with the return of the imaging module archiving. One limitation of the present study is that, due to its retrospective design, there were no data regarding the number of elective internal care hospitalizations that were considered crucial. Conclusions and relevance: The risk of ransomware cyberattacks is growing. Healthcare systems at all levels of the hospital should be aware of this threat and implement protocols should this catastrophic event occur. Careful evaluation of steady computer system recovery weekly enables vital hospital function, even under a major cyberattack. The restoration of EMR, laboratory systems, and imaging archiving modules was found to be the most significant factor that allowed the return to normal clinical hospital work.

UnSafengine64: A Safengine Unpacker for 64-Bit Windows Environments and Detailed Analysis Results on Safengine 2.4.0.

Despite recent remarkable advances in binary code analysis, malware developers still use complex anti-reversing techniques that make analysis difficult. Packers are used to protect malware, which are (commercial) tools that contain diverse anti-reversing techniques, including code encryption, anti-debugging, and code virtualization. In this study, we present UnSafengine64: a Safengine unpacker for 64-bit Windows. UnSafengine64 can correctly unpack packed executables using Safengine, which is considered one of the most complex commercial packers in Windows environments; to the best of our knowledge, there have been no published analysis results. UnSafengine64 was developed as a plug-in for Pin, which is one of the most widely used dynamic analysis tools for Microsoft Windows. In addition, we utilized Detect It Easy (DIE), IDA Pro, x64Dbg, and x64Unpack as auxiliary tools for deep analysis. Using UnSafengine64, we can analyze obfuscated calls for major application programming interface (API) functions or conduct fine-grained analyses at the instruction level. Furthermore, UnSafengine64 detects anti-debugging code chunks, captures a memory dump of the target process, and unpacks packed files. To verify the effectiveness of our scheme, experiments were conducted using Safengine 2.4.0. The experimental results show that UnSafengine64 correctly executes packed executable files and successfully produces an unpacked version. Based on this, we provided detailed analysis results for the obfuscated executable file generated using Safengine 2.4.0.

Health Data Sharing with the Goal of Value Creation; Trying to Develop a Framework Using Qualitative Content Analysis.

Introduction: Within the field of data sharing, discussions surrounding privacy concerns and big data management are extensive. This study aimed to provide a comprehensive framework for health data sharing with the objective of creating value. Methods: This study is a qualitative content analysis, which was conducted using a combination of written sources through a systematic review method, in conjunction with content derived from interviews with experts in information technology and healthcare within hospital and emergency settings. Grounded theory serves as the qualitative methodology, involving three coding phases: open, axial, and selective, facilitated by MAXQDA software. Results: Qualitative content analysis of the interviews revealed seven main (core) categories and 44 subcategories as driving factors in promoting healthcare data sharing. Simultaneously, inhibiting factors resulted in six main categories and 36 subcategories. The driving factors encompassed technology, education, patient management improvement, data utilization for various purposes, data-related considerations, legal and regulatory aspects, and health-related factors. Conversely, inhibiting factors encompassed security and privacy concerns, legal issues, external organizational influences, monitoring and control activities, financial considerations, and inter-organizational challenges. Conclusion: This study has identified key driving and inhibiting factors that influence the sharing of healthcare data. These factors contribute to a more comprehensive understanding of the dynamics surrounding data sharing within the healthcare information system.

Behind the Bait: Delving into PhishTank's hidden data.

Phishing constitutes a form of social engineering that aims to deceive individuals through email communication. Extensive prior research has underscored phishing as one of the most commonly employed attack vectors for infiltrating organizational networks. A prevalent method involves misleading the target by employing phishing URLs concealed through hyperlink strategies. PhishTank, a website employing the concept of crowd-sourcing, aggregates phishing URLs and subsequently verifies their authenticity. In the course of this study, we leveraged a Python script to extract data from the PhishTank website, amassing a comprehensive dataset comprising over 190,0000 phishing URLs. This dataset is a valuable resource that can be harnessed by both researchers and practitioners for enhancing phish- ing filters, fortifying firewalls, security education, and refining training and testing models, among other applications.

Evaluating Staff Attitudes, Intentions, and Behaviors Related to Cyber Security in Large Australian Health Care Environments: Mixed Methods Study.

BACKGROUND: Previous studies have identified that the effective management of cyber security in large health care environments is likely to be significantly impacted by human and social factors, as well as by technical controls. However, there have been limited attempts to confirm this by using measured and integrated studies to identify specific user motivations and behaviors that can be managed to achieve improved outcomes. OBJECTIVE: This study aims to document and analyze survey and interview data from a diverse range of health care staff members, to determine the primary motivations and behaviors that influence their acceptance and application of cyber security messaging and controls. By identifying these issues, recommendations can be made to positively influence future cyber security governance in health care. METHODS: An explanatory sequential mixed methods approach was undertaken to analyze quantitative data from a web-based staff survey (N=103), with a concurrent qualitative investigation applied to data gathered via in-depth staff interviews (N=9). Data from both stages of this methodology were mapped to descriptive variables based on a modified version of the Technology Acceptance Model (TAM; TAM2). After normalization, the quantitative data were verified and analyzed using descriptive statistics, distribution and linearity measures, and a bivariate correlation of the TAM variables to identify the Pearson coefficient (r) and significance (P) values. Finally, after confirming Cronbach α, the determinant score for multicollinearity, and the Kaiser-Meyer-Olkin measure, and applying the Bartlett test of sphericity (χ2), an exploratory factor analysis (EFA) was conducted to identify the primary factors with an eigenvalue (λ) >1.0. Comments captured during the qualitative interviews were coded using NVivo software (QSR International) to create an emic-to-etic understanding, which was subsequently integrated with the quantitative results to produce verified conclusions. RESULTS: Using the explanatory sequential methodology, this study showed that the perceived usefulness of security controls emerged as the most significant factor influencing staff beliefs and behaviors. This variable represented 24% of all the variances measured in the EFA and was also the most common category identified across all coded interviews (281/692, 40.6%). The word frequency analysis showed that systems, patients, and people represented the top 3 recurring themes reported by the interviewees. CONCLUSIONS: To improve cyber security governance in large health care environments, efforts should be focused on demonstrating how confidentiality, integrity, availability, policies, and cloud or vendor-based controls (the main contributors of usefulness measured by the EFA) can directly improve outcomes for systems, staff, and patients. Further consideration also needs to be given to how clinicians should share data and collaborate on patient care, with tools and processes provided to support and manage data sharing securely and to achieve a consistent baseline of secure and normalized behaviors.

Aproximación al ciberdelincuente desde la perspectiva del control social / Approaching the cybercriminal from a perspective of social control / Abordagem do criminoso cibernético a partir de uma perspectiva de controle social

El presente artículo aporta un acercamiento al ciberdelincuente identificando las características comunes en la personalidad de quienes delinquen en este escenario. Para llevar a cabo la investigación, se tomó una muestra de diecinueve expertos que forman parte de la Dirección de Investigación Criminal e INTERPOL, abordados por entrevista en profundidad. Los datos obtenidos fueron tratados desde un diseño hermenéutico con énfasis en la teoría fundamentada, por medio de tres fases elaboradas en análisis matricial de codificación abierta, selectiva y teórica; a partir de las cuales se establecen algunas de las tácticas del ciberdelincuente desplegadas en el ciberespacio a través de tecnologías de la información y las comunicaciones; su descripción desde el modelo big five y se identifican algunas de sus características como la falta de empatía, escrúpulos, incapacidad para el control de emociones, confianza y capacidad de innovar sus modus operandi(Sánchez y Robles, 2013). Finalmente, desde las teorías del control social se han estudiado el ciberdelito y los actos del ciberdelincuente de una manera formal que vela por encontrar estrategias de control del Estado, según González (2010), o informal, que busca los motivos que conducen a cometer delitos, como lo afirma López (2015), a partir de lo cual, al final, se presentan algunas recomendaciones.

This article provides an approach to cybercriminals by identifying the common characteristics in the personality of those who commit crimes in this scenario. In order to carry out the research, a sample of nineteen experts from the Criminal Investigation Directorate and INTERPOL were interviewed in depth. The data obtained were treated based on a hermeneutic design with emphasis on grounded theory, by means of three phases elaborated in matrix analysis of open, selective and theoretical coding; from which some of the tactics of cybercriminals deployed in cyberspace through information and communication technologies are established; their description based on the big five model and the identification of several of their characteristics such as lack of empathy, scruples, the inability to control emotions, confidence and the ability to innovate their modus operandi (Sánchez y Robles, 2013). Finally, theories of social control have studied cybercrime and the acts of cybercriminals in a formal way that seeks to find strategies to control the State, according to González (2010), or informally, seeking the motives that lead to committing crimes, as stated by López (2015), on the basis of which, at the end, some recommendations are presented.

Este artigo traz uma abordagem sobre os cibercriminosos, identificando as características comuns na personalidade de quem comete crimes nesse cenário. Para a realização da investigação foi recolhida uma amostra de dezanove peritos que integram a Direcção de Investigação Criminal e a INTERPOL, abordados através de entrevista em profundidade. Os dados obtidos foram tratados a partir de um desenho hermenêutico com ênfase na teoria fundamentada, por meio de três fases desenvolvidas em análise matricial de codificação aberta, seletiva e teórica; a partir da qual se estabelecem algumas das táticas cibercriminosas implantadas no ciberespaço através das tecnologias de informação e comunicação; A sua descrição baseia-se no modelo dos big five e são identificadas algumas das suas características, como a falta de empatia, escrúpulos, incapacidade de controlar emoções, confiança e capacidade de inovar o seu modus operandi (Sánchez y Robles, 2013). Por fim, a partir das teorias de controle social, o cibercrime e os atos dos cibercriminosos têm sido estudados de forma formal, que busca encontrar estratégias de controle do Estado, segundo González (2010), ou informalmente, que busca os motivos que levam ao cometimento dos crimes. , conforme afirma López (2015), a partir do qual, ao final, são apresentadas algumas recomendações.

Adversarial-Aware Deep Learning System Based on a Secondary Classical Machine Learning Verification Approach.

Deep learning models have been used in creating various effective image classification applications. However, they are vulnerable to adversarial attacks that seek to misguide the models into predicting incorrect classes. Our study of major adversarial attack models shows that they all specifically target and exploit the neural networking structures in their designs. This understanding led us to develop a hypothesis that most classical machine learning models, such as random forest (RF), are immune to adversarial attack models because they do not rely on neural network design at all. Our experimental study of classical machine learning models against popular adversarial attacks supports this hypothesis. Based on this hypothesis, we propose a new adversarial-aware deep learning system by using a classical machine learning model as the secondary verification system to complement the primary deep learning model in image classification. Although the secondary classical machine learning model has less accurate output, it is only used for verification purposes, which does not impact the output accuracy of the primary deep learning model, and, at the same time, can effectively detect an adversarial attack when a clear mismatch occurs. Our experiments based on the CIFAR-100 dataset show that our proposed approach outperforms current state-of-the-art adversarial defense systems.

Learnings From a National Cyberattack Digital Disaster During the SARS-CoV-2 Pandemic in a Pediatric Emergency Medicine Department.

OBJECTIVE: The primary objective was to analyze the impact of the national cyberattack in May 2021 on patient flow and data quality in the Paediatric Emergency Department (ED), amid the SARS-CoV-2 (COVID-19) pandemic. METHODS: A single site retrospective time series analysis was conducted of three 6-week periods: before, during, and after the cyberattack outage. Initial emergent workflows are described. Analysis includes diagnoses, demographic context, key performance indicators, and the gradual return of information technology capability on ED performance. Data quality was compared using 10 data quality dimensions. RESULTS: Patient visits totaled 13 390. During the system outage, patient experience times decreased significantly, from a median of 188 minutes (pre-cyberattack) down to 166 minutes, most notable for the period from registration to triage, and from clinician review to discharge (excluding admitted patients). Following system restoration, most timings increased. Data quality was significantly impacted, with data imperfections noted in 19.7% of data recorded during the system outage compared to 4.7% before and 5.1% after. CONCLUSIONS: There was a reduction in patient experience time, but data quality suffered greatly. A hospital's major emergency plan should include provisions for digital disasters that address essential data requirements and quality as well as maintaining patient flow.

An Adaptive Simultaneous Multi-Protocol Extension of CRAFT.

An exponential number of devices connect to Internet of Things (IoT) networks every year, increasing the available targets for attackers. Protecting such networks and devices against cyberattacks is still a major concern. A proposed solution to increase trust in IoT devices and networks is remote attestation. Remote attestation establishes two categories of devices, verifiers and provers. Provers must send an attestation to verifiers when requested or at regular intervals to maintain trust by proving their integrity. Remote attestation solutions exist within three categories: software, hardware and hybrid attestation. However, these solutions usually have limited use-cases. For instance, hardware mechanisms should be used but cannot be used alone, and software protocols are usually efficient in particular contexts, such as small networks or mobile networks. More recently, frameworks such as CRAFT have been proposed. Such frameworks enable the use of any attestation protocol within any network. However, as these frameworks are still recent, there is still considerable room for improvement. In this paper, we improve CRAFT's flexibility and security by proposing ASMP (adaptative simultaneous multi-protocol) features. These features fully enable the use of multiple remote attestation protocols for any devices. They also enable devices to seamlessly switch protocols at any time depending on factors such as the environment, context, and neighboring devices. A comprehensive evaluation of these features in a real-world scenario and use-cases demonstrates that they improve CRAFT's flexibility and security with minimal impact on performance.

Critical Criteria and Countermeasures for Mobile Health Developers to Ensure Mobile Health Privacy and Security: Mixed Methods Study.

BACKGROUND: Despite the importance of the privacy and confidentiality of patients' information, mobile health (mHealth) apps can raise the risk of violating users' privacy and confidentiality. Research has shown that many apps provide an insecure infrastructure and that security is not a priority for developers. OBJECTIVE: This study aims to develop and validate a comprehensive tool to be considered by developers for assessing the security and privacy of mHealth apps. METHODS: A literature search was performed to identify papers on app development, and those papers reporting criteria for the security and privacy of mHealth were assessed. The criteria were extracted using content analysis and presented to experts. An expert panel was held for determining the categories and subcategories of the criteria according to meaning, repetition, and overlap; impact scores were also measured. Quantitative and qualitative methods were used for validating the criteria. The validity and reliability of the instrument were calculated to present an assessment instrument. RESULTS: The search strategy identified 8190 papers, of which 33 (0.4%) were deemed eligible. A total of 218 criteria were extracted based on the literature search; of these, 119 (54.6%) criteria were removed as duplicates and 10 (4.6%) were deemed irrelevant to the security or privacy of mHealth apps. The remaining 89 (40.8%) criteria were presented to the expert panel. After calculating impact scores, the content validity ratio (CVR), and the content validity index (CVI), 63 (70.8%) criteria were confirmed. The mean CVR and CVI of the instrument were 0.72 and 0.86, respectively. The criteria were grouped into 8 categories: authentication and authorization, access management, security, data storage, integrity, encryption and decryption, privacy, and privacy policy content. CONCLUSIONS: The proposed comprehensive criteria can be used as a guide for app designers, developers, and even researchers. The criteria and the countermeasures presented in this study can be considered to improve the privacy and security of mHealth apps before releasing the apps into the market. Regulators are recommended to consider an established standard using such criteria for the accreditation process, since the available self-certification of developers is not reliable enough.

For-profit versus non-profit cybersecurity posture: breach types and locations in healthcare organisations.

BACKGROUND: The implementation of emerging technologies has resulted in an increase of data breaches in healthcare organisations, especially during the COVID-19 pandemic. Health information and cybersecurity managers need to understand if, and to what extent, breach types and locations are associated with their organisation's business type. OBJECTIVE: To investigate if breach type and breach location are associated with business type, and if so, investigate how these factors affect information systems and protected health information in for-profit versus non-profit organisations. METHOD: The quantitative study was performed using chi-square tests for association and post-hoc comparison of column proportions analysis on an archival data set of reported healthcare data breaches from 2020 to 2022. Data from the Department of Health and Human Services website was retrieved and each organisation classified as for-profit or non-profit. RESULTS: For-profit organisations experienced a significantly higher number of breaches due to theft, and non-profit organisations experienced a significantly higher number of breaches due to unauthorised access. Furthermore, the number of breaches that occurred on laptops and paper/films was significantly higher in for-profit organisations. CONCLUSION: While the threat level of hacking techniques is the same in for-profit and non-profit organisations, certain breach types are more likely to occur within specific breach locations based on the organisation's business type. To protect the privacy and security of medical information, health information and cybersecurity managers need to align with industry-leading frameworks and controls to prevent specific breach types that occur in specific locations within their environments.

General Law on Personal Data Protection and applicability to Nursing / Ley General de Protección de Datos Personales y aplicabilidad a la Enfermería / Lei Geral de Proteção de Dados Pessoais e aplicabilidade para a Enfermagem

ABSTRACT Objectives: to reflect on the impacts of the General Personal Data Protection Law on Nursing practice. Methods: reflection article, through the intentional collection of materials relating to the topic. Results: legislation regulates confidentiality, processing and data sharing, requiring institutional protection measures. The nursing team is responsible for acting preventively, both in care and in the management role, in order to avoid the misuse of the patient's personal data. The law allows academic research to be carried out as long as the purpose is clear, data collection occurs with an explicit purpose and data is anonymized. Final Considerations: although the General Personal Data Protection Law requires greater care in relation to data processing, it is established on precepts of good faith and respect for the rights of the individual, concepts aligned with the nursing code of ethics.

RESUMEN Objetivos: reflexionar sobre los impactos de la Ley General de Protección de Datos Personales en la práctica de enfermería. Métodos: se trata de un artículo reflexivo llevado a cabo mediante una recolección intencional de materiales referentes al tema. Resultados: la legislación regula la confidencialidad, el tratamiento y la puesta en común de los datos, exigiendo medidas institucionales de protección. Corresponde al equipo de enfermería actuar de forma preventiva, tanto en la atención como en la gestión, para evitar el uso indebido de los datos personales de los pacientes. La ley permite la investigación académica siempre que el propósito sea claro, los datos se recojan con un fin explícito y se anonimicen. Consideraciones Finales: aunque la Ley General de Protección de Datos de Carácter Personal exige un cuidado mayor con relación al tratamiento de los datos, se basa en preceptos de buena fe y respeto de los derechos del individuo, conceptos que están en consonancia con el código deontológico de la enfermería.

RESUMO Objetivos: refletir sobre os impactos da Lei Geral de Proteção de Dados Pessoais na prática da enfermagem. Métodos: artigo de reflexão, por meio da coleta intencional de materiais referentes ao tema. Resultados: a legislação regulamenta o sigilo, o tratamento e o compartilhamento dos dados, exigindo medidas de proteção institucionais. À equipe de enfermagem cabe agir preventivamente, tanto na assistência quanto no papel gerencial, a fim de evitar o mau uso dos dados pessoais do paciente. A lei permite a realização de pesquisas acadêmicas desde que a finalidade esteja clara, que a coleta de dados ocorra com um propósito explícito e que seja realizada a anonimização dos dados. Considerações Finais: apesar da Lei Geral de Proteção de Dados Pessoais exigir maiores cuidados em relação ao tratamento dos dados, ela é estabelecida em preceitos de boa-fé e em respeito aos direitos do indivíduo, conceitos alinhados ao código de ética da enfermagem.

A Novel Digital Research Methodology for Continuous Health Assessment of the Special Operations Warfighter: The Digital cORA Study.

The role of US Special Operations Forces (SOF) globally has expanded greatly in the past 20 years, leaving SOF serving multiple deployments with little time or ability to recover in between. Currently, assessments of the health and human performance capabilities of these individuals are episodic, precluding an accurate assessment of physical and mental load over time, and leading to high rates of acute and chronic injury to the mind and body. The collection of personal health-related continuous datasets has recently been made feasible with the advancement of digital technologies. These comprehensive data allow for improved assessment, and consequently better results, partly due to the warfighters' real-time access to their data. Such information allows Soldiers to engage in their own health optimization. This article describes a research platform that allows for collection of data via a custom-made secure mobile application that extends the type, scope, and frequency of data collection beyond what is feasible during an in-person encounter. By digitizing existing assessments and by incorporating additional physical, neurocognitive, psychological, and lifestyle assessments, the platform provides individuals with the ability to better understand their mental and physical load, as well as reserve. The results of this interactive exchange may help to preserve the health of users as well as the stability and readiness of units.

Design and Testing of a Computer Security Layer for the LIN Bus.

Most modern vehicles are connected to the internet via cellular networks for navigation, assistance, etc. via their onboard computer, which can also provide onboard Wi-Fi and Bluetooth services. The main in-vehicle communication buses (CAN, LIN, FlexRay) converge at the vehicle's onboard computer and offer no computer security features to protect the communication between nodes, thus being highly vulnerable to local and remote cyberattacks which target the onboard computer and/or the vehicle's electronic control units through the aforementioned buses. To date, several computer security proposals for CAN and FlexRay buses have been published; a formal computer security proposal for the LIN bus communications has not been presented. So, we researched possible security mechanisms suitable for this bus's particularities, tested those mechanisms in microcontroller and PSoC hardware, and developed a prototype LIN network using PSoC nodes programmed with computer security features. This work presents a novel combination of encryption and a hash-based message authentication code (HMAC) scheme with replay attack rejection for the LIN communications. The obtained results are promising and show the feasibility of the implementation of an LIN network with real-time computer security protection.

Towards a Toolbox for Privacy-Preserving Computation on Health Data.

Substantial advances in methods of collecting and aggregating large amounts of biomedical data have been met with insufficient measures of protecting it from unwarranted access and use. Most of the current layers of protection are merely aimed at ensuring compliance with regulations (e.g., the EU's General Data Protection Regulation) but do not represent a vision of privacy-by-design as an efficient and ethical advantage in biomedical research and clinical applications. This not only slows down the pace of such efforts but also leaves the data exposed to a wide spectrum of cyberattacks. This work presents an overview of recent advancements in data and compuation security, along with a discussion of their limitations and potential for deployement in both health care and research settings.

Factors Influencing the Adoption of Advanced Cryptographic Techniques for Data Protection of Patient Medical Records.

OBJECTIVES: Healthcare organizations that maintain and process Electronic Medical Records are at risk of cyber-attacks, which can lead to breaches of confidentiality, financial harm, and possible interference with medical care. State-of-the-art methods in cryptography have the potential to offer improved security of medical records; nonetheless, healthcare providers may be reluctant to adopt and implement them. The objectives of this study were to assess current data management and security procedures; to identify attitudes, knowledge, perceived norms, and self-efficacy regarding the adoption of advanced cryptographic techniques; and to offer guidelines that could help policy-makers and data security professionals work together to ensure that patient data are both secure and accessible. METHODS: We conducted 12 in-depth semi-structured interviews with managers and individuals in key cybersecurity positions within Israeli healthcare organizations. The interviews assessed perceptions of the feasibility and benefits of adopting advanced cryptographic techniques for enhancing data security. Qualitative data analysis was performed using thematic network mapping. RESULTS: Key data security personnel did not perceive advanced cybersecurity technologies to be a high priority for funding or adoption within their organizations. We identified three major barriers to the adoption of advanced cryptographic technologies for information security: barriers associated with regulators; barriers associated with healthcare providers; and barriers associated with the vendors that develop cybersecurity systems. CONCLUSIONS: We suggest guidelines that may enhance patient data security within the healthcare system and reduce the risk of future data breaches by facilitating cross-sectoral collaboration within the healthcare ecosystem.

Zero-Day Malware Detection and Effective Malware Analysis Using Shapley Ensemble Boosting and Bagging Approach.

Software products from all vendors have vulnerabilities that can cause a security concern. Malware is used as a prime exploitation tool to exploit these vulnerabilities. Machine learning (ML) methods are efficient in detecting malware and are state-of-art. The effectiveness of ML models can be augmented by reducing false negatives and false positives. In this paper, the performance of bagging and boosting machine learning models is enhanced by reducing misclassification. Shapley values of features are a true representation of the amount of contribution of features and help detect top features for any prediction by the ML model. Shapley values are transformed to probability scale to correlate with a prediction value of ML model and to detect top features for any prediction by a trained ML model. The trend of top features derived from false negative and false positive predictions by a trained ML model can be used for making inductive rules. In this work, the best performing ML model in bagging and boosting is determined by the accuracy and confusion matrix on three malware datasets from three different periods. The best performing ML model is used to make effective inductive rules using waterfall plots based on the probability scale of features. This work helps improve cyber security scenarios by effective detection of false-negative zero-day malware.

An investigation of the status and maturity of hospitals' health information governance in Victoria, Australia.

BACKGROUND: Health information governance (IG) in Australian hospitals was hitherto unexplored. OBJECTIVES: To determine hospitals' health IG status and maturity in Victoria, Australia, identify drivers and barriers affecting IG adoption, examine electronic health data breach response plan usage and assess employees' electronic data breach awareness. METHOD: Mixed-methods descriptive study utilising an online survey of directors - clinical/health information services and chief health information managers (HIMs) in Victorian hospitals, ≥50 beds. RESULTS: Response rate: 42.9% (n = 36). Fifty percent (n = 17) of respondent-hospitals had an IG program. IG equally supported decision-making and risk identification and prevention. The greatest potential organisational damages from system disruption or failure were information loss (66.7%) and clinical risks (63.9%). HIMs in 15 (55.6%) hospitals had knowledge to monitor and detect electronic data breaches. Staff in 19 (70.4%) hospitals knew who to inform about a suspected breach. Most hospitals had mature health information-related IG practices, most (88.9%, n = 24) provided IG-related education, 77.8% (n = 21) regularly reviewed data breach response plans. The strongest IG drivers were privacy-security compliance and changes to data capture or documentation practices (82.8%, n = 24); the greatest barriers were implementation complexity (57.1%, n = 16) and cost (55.6%, n = 15). CONCLUSION: These baseline Australian data show 50% of respondent-hospitals had no formal health IG program. Privacy-security compliance, and audits, needed improvement; however, most hospitals had well-developed medical record/health information IG-relevant schedules, policies and practices. HIMs, the professionals most engaged in IG, required upskilling in electronic data breach detection.

Ciberdelincuencia en Colombia: ¿qué tan eficiente ha sido la Ley de Delitos Informáticos? / Cybercrime in Colombia: how efficient has the Computer Crime Law been? / Cibercrime na Colômbia: qual tem sido a eficácia da Lei de Crimes Informáticos?

Este documento está centrado en determinar qué variables afectan los incentivos que tienen los delincuentes al cometer sus ciberdelitos, e identificar si la legislación actual está diseñada teniendo en cuenta la tipificación de las conductas y las herramientas de los entes encargados de capturar los criminales. Se busca entender los principales factores que incentivan la ciberdelincuencia en el país, teniendo en cuenta el contexto de la ciberdelincuencia para el 2019 en Colombia, y con ello, el comportamiento de los delincuentes informáticos en la prepandemia. Con la Ley 1273 de 2019, encargada de tipificar los delitos informáticos en Colombia, se revisarán los datos reportados de delitos informáticos y se compararán con los casos e indicadores de delitos de hurto calificado, con el fin de determinar la relación de estos dos delitos, que son relevantes para las entidades y han sido interiorizados por las entidades policivas en su estudio y lucha anticriminal desde hace mucho tiempo. Una vez definida teóricamente la eficiencia de las entidades apoderadas en la lucha contra los delitos informáticos, se propone una función de beneficios económicos de la ciberdelincuencia adaptada para el caso colombiano, determinando las variables que mejor explican esta función. Al final de este ejercicio académico, mediante un análisis de sensibilidad, se señala qué aspectos de política pública se deben considerar como prioritarios, teniendo en cuenta los incentivos económicos para los ciberdelincuentes y la efectividad de la Ley 1273 de 2009.

This paper is focused on determining which variables affect the incentives that criminals have when committing cybercrime, and identify whether the current legislation is designed taking into account the criminalization of behaviors and the tools of the entities in charge of catching criminals. It seeks to understand the main factors that encourage cybercrime in the country, taking into account the context of cybercrime for 2019 in Colombia, and with it, the behavior of cybercriminals in the pre-pandemic. With Law 1273 of 2019, in charge of criminalizing computer crimes in Colombia, the reported data of computer crimes will be reviewed and compared with the cases and indicators of qualified theft crimes, in order to determine the relationship of these two crimes, which are relevant for the entities and have been internalized by the police entities in their study and anti-crime fight for a long time. Once the efficiency of the entities empowered in the fight against cybercrime has been theoretically defined, a function of economic benefits of cybercrime adapted to the Colombian case is proposed, determining the variables that best explain this function. At the end of this academic exercise, through a sensitivity analysis, it is pointed out which aspects of public policy should be considered as a priority, taking into account the economic incentives for cybercriminals and the effectiveness of Law 1273 of 2009.

Este documento está focado em determinar quais variáveis afetam os incentivos que os criminosos têm quando cometem crimes cibernéticos, e identificar se a legislação atual é elaborada levando em conta a classificação dos comportamentos e as ferramentas das entidades encarregadas de capturar os criminosos. Ela procura compreender os principais fatores que incentivam o cibercrime no país, levando em conta o contexto do cibercrime para 2019 na Colômbia, e com ele, o comportamento dos cibercriminosos na pré-pandemia. Com a Lei 1273 de 2019, encarregada de criminalizar os crimes cibernéticos na Colômbia, os dados comunicados de crimes cibernéticos serão revistos e comparados com os casos e indicadores de crimes de roubo, a fim de determinar a relação entre esses dois crimes, que são relevantes para as entidades e foram internalizados por entidades policiais em seu estudo e combate aos crimes por um longo tempo. Uma vez definida teoricamente a eficiência das entidades habilitadas na luta contra o crime cibernético, propõe-se uma função dos benefícios econômicos do crime cibernético adaptada ao caso colombiano, determinando as variáveis que melhor explicam esta função. Ao final deste exercício acadêmico, por meio de uma análise de sensibilidade, indica-se quais aspectos das políticas públicas devem ser considerados prioritários, levando em conta os incentivos econômicos para os cibercriminosos e a eficácia da Lei 1273 de 2009.