Hacking countermeasure framework for oman computer emergency readiness team using delphi approach

Abstract

Recent security attacks have breached some of the most secure networks around the world causing damages, stealing information, and data corruption. This devastating situation has led security experts to question the effectiveness and reliability of the present security controls against the hacking attacks. Thus, there is a need to prevent systems hacking and fulfil managerial concerns about security risks. This research focuses on the design and development of Hacking Countermeasure Framework (HCF) using Delphi method that combines quantitative and qualitative research questionnaires to address problems associated with the lack of hacking anticipation, hiding and deception, and Defense-in-Breadth (DiB) techniques. This research was conducted via an online, anonymous, and asynchronous six-round Delphi methodology adapted from the classical Delphi method with a pre-selected security experts panel. The study was arranged in four Delphi phases. Phase one covers analysis of studies that have used pre-Delphi to explore hacking threats and the provided recommendations for anti-hacking. Phase two covers derivation of factors for identifying anti-hacking factors and their relationships. Phase three covers development of a framework to prevent systems hacking and fulfil managerial concerns regarding security risks. Finally, phase four covers validation of the research deliverables using triangulation with five processes, namely study cases, interviews, discussion workshop, review and quality assurance by cyber security experts, and approval by CERTs. The findings of this research confirms the importance of hacking anticipation, hiding and deception, and DiB in a hacking countermeasure process and provides enticing clues regarding the role of these three factors in the hacking countermeasures. Despite recent calls for the replacement of Defense-in-Depth (DiD), this research also confirms that DiD plays a vital role in anti-hacking processes. Moreover, a clear linkage is identified between hacking risk assessment, anti-hacking auditing, and anti-hacking compliance. Furthermore, the validation of framework confirms that hacking countermeasure improves through the induced solutions for DiB, and deception and hiding techniques. The HCF is useful for both academia and industry and can contribute to theory and practice of hacking anticipation, DiB, and hiding and deception.