The article focuses on hybrid threats' study in the civil security sector in Ukraine. The main emphasis is on evaluative variations in the perception of the capacity or vulnerability of the law enforcement system. The analysis covers the whole range of activities of the Ministry of Internal Affairs of Ukraine, taking into account the activities of National Police, National Guard, State Border Service, State Emergency Service, State Migration Service and service centers. An empirical study of the relationship between cyberattacks and cyber-hygiene in the civil security sector is presented. Unique empirical materials are used - the results of a survey of specialists of the Ministry of Internal Affairs and these CEBs on the identification and assessment of hybrid threats in the civil security sector, as well as quantification of the ability of law enforcement agencies to combat these threats. The basic characteristics of cyber-hygiene are used to estimate the level and impact of internal and external factors of law enforcement. Based on the application of linear regression, the risk assessment of the spread of hybrid cyber threat "use of cyber operations" is assessed, priority risk reduction factors are identified and an appropriate forecast model is built. Hybrid threats, civil security sector, central bodies of executive power of the Ministry of Internal Affairs, capacity, vulnerability, correlation, risk assessment, regression analysis CMiGIN 2022: 2nd International Conference on Conflict Management in Global Information Networks, November 30, 2022, Kyiv, Ukraine ORCID: 0000-0001-9056-5475 (O. Korystin); 0000-0002-0983-2116 (N. Svyrydiuk); 0000-0002-5938-3400 (G. Sobko); 0000-0001-87322421 (O. Mitina); 0000-0003-2619-1063 (M. Aleksander)
civil
Building an independent state, an important area of security for Ukraine is countering hybrid threats
which show the specifics of their distribution in the civil security sector. The adequacy of such activities
objectively requires raising awareness of such threats’ prevalence, understanding of their content and
the ability to reduce the risk of their spread. The issue of combating hybrid threats covers the problems
of national security quite broadly and comprehensively. This, above all, requires significant analysis of
the situation, the study of those factors that cause the inability to effectively combat hybrid threats, in
particular in the areas of public safety and civil protection [
2022 Copyright for this paper by its authors.
Hybrid threats have been the subject of research by many scientists around the world. Therefore, it
is the subject of discussion among politicians, problem international organizations are trying to solve.
Development of certain ways of counteraction to hybrid threats is also a subject of research by scientists
of the most various branches, in particular: the essence and structure of hybrid war (E. Magda [
In recent years, research has been conducted in the field of cybersecurity: the principles of building
a modern communication system are formulated and the requirements for them are determined [
Analyze hybrid cyber threats in the civil security sector, factors capable of counteracting cyber operations and identify basic ones that ensure a certain level of cyber hygiene. Develop a process for assessing the risks of the spread of cyber operations in the civil security sector and build an appropriate model and forecast.
Developing theoretical and applied aspects, scientists of the Research Institute of the Ministry of
Internal Affairs of Ukraine participated in several research projects to implement the general concept
of strategic analysis based on risk assessment of modelling and forecasting, in particular - strategic
analysis of hybrid threats in the civil security sector [
Based on the analysis of the risk of the spread of hybrid cyber threats in the civil security sector, the following are highlighted (Fig. 1):
Cyber-attacks against critical infrastructure facilities (52.25%) and central bodies of executive power (50.03%) have the highest risk of spreading. The risk of using cyber operations (49.29%) as a generalizing indicator of hybrid cyber threats was identified at the same high level.
Further analysis was conducted with an emphasis on the generalizing indicator "use of cyber operations". Based on the correlation analysis, internal and external factors that have a certain statistical relationship with this threat are identified. Internal factors are divided into two groups: the strengths and weaknesses of the subjects of the civil security system in combating hybrid threats. 28 correlates were identified from the list of strengths and 9 - weaknesses. Among the external factors (opportunities to increase the effectiveness of countering hybrid threats) identified 27 correlates with the threat of using cyber operations.
using Bot-net to manage computers in the…
using phishing web resources to gather… attacks or interference in the work of state… unauthorized access to private and official…
interference in the electoral system use of software products for covert collection…
DDoS attacks - distributed cyberattacks cyber attacks against critical infrastructure cyber-attacks against CEBs use of cyber operations:
Expertly from the general list of correlates, the internal and external factors forming basic bases of cyber-hygiene in the system of bodies of civil safety are defined (Table 1). Тable 1
services of detective services operate
13 The procedure for selection for service has been improved (in the bodies of the Ministry of Internal Affairs system)
16 Cybersecurity is provided in the units of the system of the Ministry of Internal Affairs 24.1 Cybersecurity critical infrastructure is protected 27 Level of use of licensed software and security systems 31.1 Conformity of initial (basic) training 31.2 Compliance of professional education in higher education institutions of the Ministry of Internal Affairs 31.3 Conformity of advanced training 36 The level of response of the organs of the Ministry of Internal
professional competencies
Use of cyber operations -,138** -,113* -,143** -0,074 -,092* -,222** -,115* -,110* -,113*
(superintendential) level
in the SGBC
18.6 Raising the intellectual level of employees of the Ministry of
18.7 Improving the technical equipment of the organs of the
21 The involvement of international technical assistance to: 21.1 holding reforms in the organs of the Ministry of Internal
21.2 technical re-equipment of the system of the Ministry of
21.3 training of personnel of the organs of the system of the
operations -.266** -.170** 0,000 0,000 Use of cyber P value operations .160** 0,000 .216** .129** .191** .169** .166** .200** .192** 0,000 0,005
Further analysis was performed using linear regression. The array of data obtained was analyzed by the method of step by step inclusion, step by step exclusion, and finding the best subsets. The conclusion about the adequacy of the model was inferred by the F-criterion at a given level and relatively high scores of the multiple (Fig. 2, Table 2):
Taking into account the estimated values and applying the linear regression model, the risk of spreading the use of cyber operations in the presence of cyber hygiene in the civil security system is determined (Fig. 3) and a forecast of reducing the risk of cyber operations in the civil security sector is constructed (Fig. 4, 5):
(Constant) 8.1 Insufficient level of professional training at the management level (Constant)
of professional training at the management level 31.1 Compliance of primary preparation 58,813 -0,201 71,908 -0,198
Std.
Err. 1,966 0,033 3,237 0,033
Beta -0,266 -0,261 29,913 -6,034 22,218 -6,071 -0,220 0,044 -0,216 -5,023
Taking into account the estimated values and applying the linear regression model, the risk of spreading the use of cyber operations in the presence of cyber hygiene in the civil security system is determined (Table 3) and a forecast of reducing the risk of cyber operations in the civil security sector is constructed (Table 4, 5).
Further analysis was continued, taking into account some differences of experts’ opinion on the risk level of using cyber operations as a hybrid threat (Fig. 2). The frequency response of the generalized data indicates a significant divergence of experts' opinions. Less than 10 percent of experts report a low level of risk (1.71%; 6.29%; 12.0%). 13 percent of respondents determine the level of risk to 20%, and almost the same - 10 percent of respondents - about 100%. However, the vast majority of experts (about 70%) focus on the level of risk in the range of 37.14 - 68.57%. This discrepancy is also quite inaccurate, although the average value of the risk of using cyber operations is determined at 49.29%.
That is, hypothetically, there is a possibility of different risk assessments of cyber operations’ using different samples, in particular, in relation to the scope of activities for the specifics of law enforcement. In this regard, the risk level of using cyber operations as a hybrid threat was calculated taking into account the area of professional activity of the expert, i.e. by type of law enforcement agency (Table 6). Indeed, the hypothesis of a discrepancy in the assessment of the risk level of the use of cyber operations in hybrid warfare is confirmed. There are significant differences in the samples of experts from different law enforcement agencies. The highest level of risk is 60.51%, according to the experts of the Ministry of Internal Affairs of Ukraine. At the same time, experts working in the SESU (45.08%) and the SBGS (46.66%) focus on slightly lower than average values (49.29%).
Given these differences, it is logical to make statements about possible discrepancies in the samples and to assess the ability of some law enforcement agencies to counter cyber operations, in particular, taking into account the basic requirements of cyber hygiene. Appropriate linear regression models were developed for verification (Table 6, 7, 8, 9, 10).
The developed model of linear regression of the use of cyber operations, according to experts of the Ministry of Internal Affairs, emphasizes the importance of the following predictors of cyberhygiene: a significant vulnerability of cyber hygiene is the appointment of persons outside professional competencies (-0.433); as well as capacity building requires access to the best foreign practices of practical activities (0.113) and the formation of a professional core of work teams (0.123).
The developed model of linear regression of the use of cyber operations, according to experts of the Ministry of Internal Affairs, emphasizes the importance of the following predictors of cyberhygiene: a significant vulnerability of cyber hygiene is the appointment of persons outside professional competencies (-0.433); as well as capacity building requires access to the best foreign practices of practical activities (0.113) and the formation of a professional core of work teams (0.123).
Therefore, the model of linear regression of cyber operations, according to NGU experts, emphasizes the importance of increasing the level of financial support for the development of educational, scientific and research activities in the NB and significant vulnerability of educational and scientific institutions to strategic research in the NB.
The model of linear regression of cyber operations’ using, according to NPU experts, highlights only significant vulnerabilities in the training of management level. This in some way corresponds to the general trend based on average values. This is also the case in the constructed model of linear regression (Table 10) of the sample, taking into account the opinion of SBGS experts.
Therefore, the linear regression model (Table 11) of the use of cyber operations in hybrid warfare, according to SESU’s experts on vulnerability, emphasizes the lack of training of both managers and staff and the inability of educational and research institutions to strategic research in national security; and also needs to increase the capacity to attract international technical assistance for the training of staff of the Ministry of Internal Affairs of Ukraine.
Thus, hybrid cyber threats in the civil security sector have been identified, among which cyberattacks against critical infrastructure facilities (52.25%) and central bodies of executive power (50.03%) have the highest risk of spreading. The risk of using cyber operations (49.29%) as a generalizing indicator of hybrid cyber threats was identified at the same high level.
Using correlation analysis and linear regression model: the risk assessment of the use of cyber operations in the civil security sector was conducted - 49.32%; priority risk reduction factors have been identified and the level of capacity for them has been determined - an insufficient level of professional training at the management level (47.14%) and compliance with initial training (60.24%); the forecast is based on an increase in capacity by 10 and 20 percent and a reduction in the risk of using cyber operations, respectively 45.14% and 40.96%. At the same time, the level of risk of using cyber operations in a hybrid war is assessed rather ambiguously by sample experts on the basis of a professional body in the system of the Ministry of Internal Affairs. The highest level of risk is 60.51%, according to experts of the Ministry of Internal Affairs of Ukraine, and lower than the average (49.29%) is determined by experts of the State Emergency Service of Ukraine (45.08%) and the State Border Guard Service of Ukraine (46.66%).
The developed models of linear regression on the basis of sampling by the body of the system of the Ministry of Internal Affairs have formed an opportunity to identify key predictors that form the basic principles of cyber hygiene in law enforcement agencies. [15] A. Cederberg, P. Eronen, How can societies be defended against hybrid threats, Strategic Security
Analysis 9(1) (2015) 1–10. [16] N. Svyrydiuk, Y. Likhovitskyy, P. Polián, Information Threats in the Context of Hybrid War,
Advances in Economics, Business and Management Research 188 (2021) 114–119. [17] A. Tikhomirov, N. Kinash, S. Gnatyuk, A. Trufanov, O. Berestneva, A. Rossodivita, S. Gnatyuk, R. Umerov, Network Society: Aggregate Topological Models, in: A. Dudin, A. Nazarov, R. Yakupov, A., Gortsev (Eds.), Information Technologies and Mathematical Modelling, Communications in Computer and Information Science, volume 487, Springer, Cham, 2014. https://doi.org/10.1007/978-3-319-13671-4_47. [18] A. V. Kharybin, O. N. Odaryshchenko, About the approach to the decision of questions of a choice of methodology of an estimation of system reliability and survivability of information systems of critical application, Radiotechnical and computer systems 6(18) (2006) 61–70. [19] Z. Hu, V. Gnatyuk, V. Sydorenko, R. Odarchenko, S. Gnatyuk, Method for Cyberincidents Network-Centric Monitoring in Critical Information Infrastructure, International Journal of Computer Network and Information Security 9(6) (2017) 30–43.