A taxonomy for cybersecurity standards

Cybersecurity as standardization priority in policymaking

A standard is a technical document used as a rule, guideline, or definition. Standards are developed from a group of interested parties (i.e., manufacturers, consumers, and regulators of particular material/products/processes/services) and provide a consensus-built, repeatable dimension^[9]. European Standards (EN) are implemented by ETSI^[10], the national CEN and CENELEC^[11].

Cybersecurity is considered a high standardization priority since cyber threats affect multiple sectors. Cybersecurity and data protection are rapidly growing, changing technical and application domains.

The threats and requirements are increasing dramatically with the progress of digitalization and the rising number of critical assets digitalized and accessible online. Within the last decades, the exponential evolution of digital technology among heterogeneous infrastructures of dispersed nodes^[12] and the COVID-19 disease has raised the investment in distance work and digital communication. Geopolitical changes and the Ukrainian war increased cyberattacks, whereas the potential of personal data leaks threatens the global digital economy. Internet of Everything (IoE)^[13], the networked connection of people, processes, data, and things via the Internet, is the norm for complete digitalization. The requirements of the global ecosystem gradually increase, promoting accelerated productivity to smart objects, such as wearable devices, sophisticated sensor networks and 5G-connected semi-autonomous or autonomous agents, raising the investment in machine-to-machine communication^[14].

In the new digital era, the application of emerging technologies, such as augmented reality, global AI, Adversarial Learning, etc., in our daily businesses and the use of digital identity^[14] by citizens requires specific practices and guidance on how to manage and monitor and concurrently maintain the security within organizations. The work in^[15] stresses the need to boost standardization initiatives and policymaking associated with AI security. More standards for securing AI, 5G and IoT are gradually developed by prominent standardization bodies, addressing various aspects at different levels, with overlaps and diverging approaches^[16].

The interplay of EU legislation and international standardization

Security policies in Europe drive us to use and develop standards. For instance, the NIS Directive on Security of Network and Information Systems^[17], the most important EU legislation instrument, requires assessing and managing cyber risks among interconnected Critical Infrastructures (CIs). The Critical Entities Resilience Directive (CER)^[18] and the proposed Cybersecurity Resilience Act (CRA)^[19] stress the need for CI protection and introduce common cybersecurity requirements to apply throughout the expected lifecycle of devices, respectively. ETSI TR 103 866 V1.1.1^[20] and indicative families of standards, i.e., ISO2700x and ISO2800x series, can guide stakeholders to raise compliance with such directives. CEN and CENELEC have introduced numerous sector-specific cybersecurity standards to stress the CI security requirements of critical EU industries^[21]. Consequently, security standardization brings trustworthiness to ICT products, spreads knowledge among multiple stakeholders, increases CI protection, and secures digital services.

Cybersecurity certification efforts are accelerating in Europe^[22-23] due to the Cybersecurity Act^[4], the EU legislation which promotes the certification of EU ICT products, services and processes, addressed by the ENISA Candidate Cybersecurity Certification Scheme (EUCC)^[24] and the recent EU implementing act^[25], and two additional ENISA cybersecurity certification schemes, i.e., European Cloud Certification Scheme (EUCS) generic cloud scheme^[26] and European cybersecurity certification scheme for 5G networks (EU5G)^[27]. The EU Cybersecurity Act (EUCSA) relies on international standards for ICT evaluation and conformity assessment^[28-30]. Furthermore, cybersecurity certification addresses market fragmentation, increases security, and strengthens the confidence of stakeholders to establish a competitive and resilient EU DSM. ISO and IEC are working on creating a Universal Cybersecurity Labelling Framework [ISO/IEC 27404 (https://www.iso.org/standard/80138.html)], aiming to guide the development and implementation of IoT certification. This involvement is crucial for aligning this new standard with already established IoT security standards, such as ETSI EN 303 645^[31] and NISTIR 8425^[32] guidance, the primary works for most IoT device specifications worldwide.

Nonetheless, security policies are highly interrelated within the EU. For instance, the EUCSA sets the need for privacy and data protection regulation^[33] and for electronic transactions protection in the internal market (eIDAS Regulation)^[34]. Privacy and data protection, promoted by General Data Protection Regulation (GDPR)^[33], is enhanced to resolve specific matters on natural and legal person rights in the provision and use of electronic communications services by the European ePrivacy Regulation^[35]. In this context, privacy-by-design specifications, privacy assessment and management standards are required, such as EN 17529:2022^[36], ISO 3300x series on process assessment^[37], ISO/IEC 2700x family of standards, and CEN ISO/IEC/TS 27006-2:2022^[38], ISO/IEC 27701:2014^[39] on privacy information management. The proposed European Data Act^[40], which complements the Data Governance Act^[41] (i.e., a key pillar of the EU strategy of data), developed to define measures, rules and mechanisms related to industrial data and their accessibility, starts getting into force.

The EUCSA emphasizes the requirement of securing the growing EU markets of the chip industry (i.e., automated cars, cloud and IoT connectivity, space, defense and supercomputers). Chips assumed strategic assets playing a critical role in ICT supply chains. To leverage technological leadership, the EU has started preparing the European Chips Act^[42]. In this vein, CEN CENELEC initiates a working group to strengthen the microchip standardization effort in the EU^[43].

Eventually, the EUCSA highlights the importance of analyzing emerging technologies. To this aim, the European Artificial Intelligence Act^[44] regulation proposal is prepared to secure AI-based systems within the EU borders. CEN CENELEC, upon the request of the European Commission, has established the Joint Technical Committee 21 to produce standardization deliverables on AI^[45], whereas ENISA is working on an AI cybersecurity certification scheme^[46].

To improve the preparedness, detection, and response to large-scale cybersecurity incidents across the EU, the European Commission proposed the EU Cyber Solidarity Act^[47], applied using international standards on incident management, such as ISO/IEC 27035^[48] and NIST recommendations for incident handling^[49].

All these EU regulations correspond to the EU Cybersecurity Strategy aiming to “build resilience to cyber threats and ensure citizens and businesses benefit from trustworthy digital technologies”^[50]. Table 1 presents direct or indirect relations between indicative EU legislative instruments and corresponding international or European standards.

The need for cybersecurity standardization classification

Over the past three decades, ICT standards have risen exponentially by a non-stop standards-making ecosystem. The effort of ETSI to enumerate standards venues associated with the proposed EU CRA^[19] identified more than 750 of them, originating from different ICT communities of various types of institutional arrangements, technologies, services and working groups^[51].

The JRC Technical Report (TR)^[8] describes cybersecurity as an interdisciplinary domain engaging a wide use of its application to all industry sectors, embracing different sizes and types of enterprises [e.g., small and medium-sized enterprises (SMEs)/medium-sized enterprises (MEs) and large enterprises], various dimensions (e.g., cyber/physical) utilizing multiple sources addressing some of the most widely-accepted standards, international working groups and classification systems.

This standardization priority of cybersecurity drove the development of several Standard Development Organizations (SDOs), often overlapping in terms of interests and goals and may even, occasionally, act as competitors, which may lead to inconsistencies and redundant requirements that may be confusing to businesses and hurdle their effective use^[52].

The list of security standards is wide-ranging and exhaustive, hindering stakeholders from determining which standards can cover their organizational needs. The great variety of standards, recommendations and best practices hinders identifying their interrelations, which would facilitate their understanding.

Considering all these drawbacks of the chaotic list of similar, different, or overlapping security standards, there is a compelling need for their classification into conceptual groups that could better communicate their existence and use to stakeholders.

ETSI standardization body has identified basic principles and practices for ICT standardization and provided a classification of the different types of standardization documents regarding their scope and addressed stakeholders, examining whether they provide requirements or recommendations (normative documents) or communicate relevant information, followed by all SDOs^[52]. Moreover, the International Classification for Standards^[53] classifies international, regional, and national technical standards and other normative documents designed to map standards in general with every economic sector and virtual activity of humankind used. Notwithstanding, the classification does not address specific aspects of security.

Few attempts to further conceptualize standards have been published already. ENISA has provided a risk management standards framework that analyzes standardization requirements in support of cybersecurity policy and outlines gaps in the domain^[6]. The risk management library can guide stakeholders in applying them in their organizations without providing a taxonomy. JRC TR on European Cybersecurity Centers of Expertise Map^[8] provides a high-level classification and set of definitions of widely-known standards, international working group classification systems, regulations, best practices, and recommendations in the cybersecurity domain. Nevertheless, the work does not address relations with cybersecurity skills of stakeholders. The European Cybersecurity Skills Framework (ECSF) of ENISA^[7] aims to profile twelve typical cybersecurity professional roles along with their identified titles, missions, tasks, skills, knowledge and competencies and facilitate individuals, employers, and providers of learning programs within the EU to bridge the gap between the cybersecurity professional workplace and learning environments. The work does not include relations to cybersecurity standards.

The literature reviews limited research work on security standardization classification. The work in^[54] provides a narrative review of the most frequently used cybersecurity standards and frameworks based on existing research work and their application to assist organizations in selecting the cybersecurity standard that best fits their cybersecurity requirements. The work mainly differentiates cybersecurity standards from frameworks and does not further categorize them into cybersecurity conceptual groups. Syafrizal et al. group international cybersecurity standards into general, local regulation, and industry-specific standards and map the relationship between the literature review and future research^[54]. The proposed classification does not consider aspects of stakeholders. It could be enriched with current trends (e.g., IoT security, blockchain-based cybersecurity, etc.). Tsohou et al. review, analyze and classify information security standards in the clauses of the ISO/IEC 27001:2005 to facilitate security practitioners in understanding the plethora of security standards^[55,56]. The current work is limited to specific ISO/IEC standards and does not address other standardization activities of information security.

The necessity for organizations to adhere to multiple standards at once can be both expensive and labor-intensive. Striving to fulfill diverse requirements often results in confusion and a perceived disorder, particularly when conflicting or overlapping standards. In this paper, we propose a taxonomy to help organizations understand which, how, and when to use cybersecurity standards depending on the use.

Structure and main pillars

The proposed taxonomy aims to guide stakeholders (e.g., organizations, practitioners, and individuals) on which standard(s) are relevant for them. Relevance is determined by a conceptual four-pillar classification, as presented in Table 2:

The categories of pillars are described below [Figure 1]:

Figure 1. Overall view of the proposed standards-based taxonomy of security management.

● Pillar-I. Industrial Sectors: Fifteen (15) industrial sectors (categories) are defined, according to their value and impact on the EU economy in case of their service disruption. The categorization relies on the EU NIS 2 Directive^[17] operators of essential/important services distinction and JRC sectorial classification^[8].

● Pillar-II. Stakeholder Profile: It provides fourteen (14) different categories of expertise and/or professions related to cyber/physical security based on the ENISA ECSF report^[7].

● Pillar-III. Security Domain: It refers to thirteen (13) security fields of knowledge (categories) from both cyber and physical aspects addressing existing security challenges of the EU economy^[8].

● Pillar-IV. Applications and Technologies: It corresponds to seventeen (17) types of devices/data/techniques/technologies (categories) utilized by the stakeholder^[8].

Since the stakeholder needs are identified in a quad selection set (options from the four pillars), the latter shall specify “why” the entity needs security standardization. Standard(s)/framework(s)/best practice(s) are distinguished into generic conceptual groups based on their content and purpose of use, as displayed in Table 3 and indicative examples presented in the following:

● ISO/IEC 27000 standard^[59] provides a basic vocabulary (Awareness) for information security management (Pillar-III), applied to ICT systems (Pillar-IV) by a Chief Information Security Officer (CISO, Pillar-II) in the Energy sector (Pillar I).

● ISO/IEC 15408 standard^[28] provides the criteria (Requirements Identification) to evaluate security properties (Pillar-III) of IoTs (Pillar-IV), assessed by a cybersecurity auditor (Pillar-II) in Healthcare (Pillar-I).

● The ETSI-Threat, Vulnerability, Risk Analysis (TVRA) technical specification^[22] or ISO/IEC 18045 standard^[29] defines (Methodologies) the minimum actions performed by a cybersecurity auditor (Pillar-II) to conduct a cybersecurity risk assessment (Pillar-III) on AI-based systems (Pillar-IV) supporting Maritime Transport (Pillar-I) operations concerning the evaluation criteria (Pillar-III) prescribed in ISO/IEC 15408 standard.

● ISO 28004 standard^[60] provides guidelines (Implementation) to an ICS/SCADA Cybersecurity Analyst (Pillar-II) in the Manufacturing sector (Pillar-I) for the security management (Pillar-IV) of supply chain systems (Pillar-IV), analyzing typical inputs/outputs of supply chain security requirements addressed in ISO 28000:2022^[61] standard.

Considering the building blocks mentioned above, Figure 1 depicts the structure of the proposed taxonomy.

Semantic relations

The cybersecurity standards engage a set of attributes:

● Range: Indicates their applicability at the International, Regional (e.g., European) or National level.

● ID/Version/Title/Year: The standard/framework/best practice publication characteristics, i.e., its ID, version, title, and the year published.

● Publisher/Technical Committee: The Standardization Body, Policymaker, or other relevant party who developed/published the standard/frameworks/best practice (it can be an association of entities).

● Purpose of Use (Why?): Regarding the content, usage is specified following the classification described in Section Structure and Main Pillars Standard/frameworks/best practices can be mapped with one (1) or more purposes of use.

● Type: Concerning ISO and IEC technical processes^[62] on standards lifecycle and their level of completeness, standards documents can be characterized by the following main types: a published standard, TR [TR is informative and non-normative, analyzing specific topics with complementary information (e.g., testing approaches, measurements, methodologies, and test cases).], Technical Specification (TS) [TS approaches an international standard in detail and completeness. Nevertheless, it has not yet passed through all approval stages (considering either premature or not reached consensus).], Approved Work Item (AWI), Publicly Available Specification (PAS) [PAS aims to boost standardization activity towards rapidly evolving technologies and respond to an urgent market need], treaty, best practice, or other type of guidance assigned by a relevant entity.

Upon stakeholder pre-defined selections in the taxonomy, a list of associated standards and their attributes are reported in a tabular structure, as depicted in Table 4.

All taxonomy elements, i.e., standards attributes, pillars, and purpose of use, are connected via semantic properties depicted in Table 5. Properties creating reciprocal relationships between two elements generate inverse relations (of inverse properties), e.g., “Operates” and “isOperatedBy”, whereas some properties have a specific type of value, e.g., “Integer”.

Concerning taxonomy hierarchies, the following semantic rules are identified:

● A Pillar (e.g., “Pillar-III: Security Domain”) is a classOf category (e.g., “Cryptology”), whereas a category is subclassOf Pillar

● All classes/subclasses can have a set of values/instances (e.g., “Cybersecurity_Standards” class has “ISOIEC15408” instance)

● All classes, subclasses and instances can be subjects and objects, associated with semantic properties

● Semantic properties (e.g., “Defines”, “Supports”, etc.) are relationships between a subject (e.g., “Cybersecurity_Standard”) and an object (e.g., “Purpose_Of_Use”)

● Special characteristics of semantic relations between classes and/or instances (e.g., Inverse relations and Integer values) are expressed via semantic properties.

The proposed taxonomy is represented in semantic ontology structure using Web Ontology Language Version 2 (OWL 2) language of description logic and Resource Description Framework (RDF) in Protégé Open-source Ontology Editor^[63]. It is built on the main taxonomy elements, described previously:

● the four conceptual pillars represent four superclasses embedding subclasses to address the corresponding categories, described in Section Structure and Main Pillars.

● attributes/types of standards and related reports are represented by five superclasses, i.e., range, type, (publication) characteristics, publisher/technical committee and purpose of use, containing subclasses to express the corresponding options, analyzed in Table 4.

● all classes may embed several individuals (instances of ontology’s classes), e.g., “Methodology” class of “Purpose of Use” superclass contains the “ISOIEC18045” individual.

● all instances are connected via object properties with other instances or via data properties specific values (e.g., integer, Boolean, etc.) to declare their semantic relations [Table 5].

● all semantic rules previously described are followed in the current ontology.

Figure 2 illustrates the high-level structure of the OWL 2 ontology. Figure 3 depicts indicative ontology’s individuals and semantic relations (properties) of Table 5 expressed in RDF framework. In Figure 3, the different colors in the arrows between individuals represent their connections with different properties, e.g., brown for property Range orange for property Evaluates. The pink arrows represent the relations between classes and individuals, e.g., class “International” has Individual “ISOIEC15408”.

Figure 2. A snapshot of Cybersecurity Standards ontology high-level structure illustrating the Stakeholder’s Profile and relations between classes. CISO: Chief Information Security Officer.

Figure 3. Cybersecurity Standards indicative instances depicting their semantic relations expressed via RDF semantic object and data properties in Protégé. ISO/IEC: International Organization for Standardization/International Electrotechnical Commission; CISO: Chief Information Security Officer; RDF: Resource Description Framework.

Scenario description

The interested party has answered the relevant conceptual questions Q1-Q4 (cf. Section "Structure and Main Pillars) of the taxonomy as presented in the following, showing in italics the subsequent selections on the taxonomy, according to the scenario:

● Q1: He works in the Maritime Transport (Pillar-I: Sector)

● Q2: He is a/an CISO/InfoSec Manager (Pillar-II: Security Stakeholder Profile)

● Q3: Aiming to assess the organization’s infrastructure for cyber risks and investigate whether the Target of Evaluation (TOE) meets cybersecurity requirements upon specified risk appetite and assurance level (Pillar-III: Security Domain; the current scenario resides in the “Evaluation, Assurance, audit and certification” category)

● Q4: The TOE is the vessel management system that utilizes AI Technologies and Machine Learning algorithms (Pillar-IV: Applications and Technologies)

Following the proposed taxonomy, the preferences on the conceptual pillars are depicted [Figure 4].

Figure 4. Quad selection of stakeholders on the conceptual pillars of the taxonomy to identify relevant Standards/Frameworks/Best practices for the security management of the TOE. TOE: Target Of Evaluation.

Concerning standards' purpose of use, all categories are relevant (e.g., requirements/methodology/implementation standards help assess risks, awareness standards in understanding the threat landscape).

Results

Novel AI-based technologies produce a wave of new diffused threats that cannot be holistically identified, prevented, and controlled as these technologies are still a new area of investigation. Future research could explore potential weaknesses and means to improve their security. Considering that emerging technologies can be partially protected, the AI technologies category (Pillar-IV) of the proposed taxonomy aims to gather information on prominent existing standards developed to address threats and vulnerabilities of AI systems and eliminate these security gaps. Standards/Frameworks/Best practices for AI-based systems are presented under two perspectives:

● standards and practices for utilizing AI technologies to secure interconnected systems (AI security)

● standards for securing AI-based systems (Secure AI).

The ETSI Industry Specification Group on Securing Artificial Intelligence (ISG SAI) has developed standards to preserve and improve the security of AI-based systems focusing on three topics:

● using AI to enhance security

● addressing attacks that leverage AI

● securing AI-based systems from attacks

AI-based Standards/Frameworks/Best Practices of the current results are generated considering the scenario pre-defined criteria (cf. Section "Scenario Description). The results of the overall taxonomy are depicted in a tabular structure, reflecting Standards/Frameworks/Best Practices and their attributes (cf. Section "Semantic Relations"), according to stakeholder’s preferences (four pillars) and standards’ purpose of use (cf. Section "Structure and Main Pillars"). Some of them were found in more than one pillar category. The results presented in Table 6 were prioritized following stakeholders’ preferences (four pillars). Standards related to IT Evaluation and conformity assessment for Maritime Transport infrastructures, specifically for AI-based systems, are prioritized along with some indicative methodologies and frameworks proposed for adoption.

Figure 5 depicts instances of prominent standards/frameworks and best practices related to the topics of interest, derived from the respective ontology classes of “Maritime” (Pillar-I), “Security_Evaluation” (Pillar-III), and “AI” (Pillar-IV). The InfoSec Manager may consult them and decide which of them should adopt to cover the security needs of organizations.

Figure 5. A combination of cybersecurity standards, frameworks and best practices related to security evaluation of AI/ML-based infrastructures together with sectorial cybersecurity guidelines for maritime transport. AI: Artificial Intelligence.