The increasing sophistication of cyber risks has made it challenging for organizations to assess their business impacts. The key challenge is the technical and language “barrier” between cybersecurity teams and business teams who make strategic investment decisions on cybersecurity. This often leads to delays, budget issues that prevent timely responses to cyber incidents. Existing research lacks a transparent, traceable, and reproducible method to communicate cyber risks and their impacts on businesses. We introduce a novel cyber risk economics model for organization-wide risk management (CYREM-ORM) that captures complex cyber risks and expresses them using financial terms. This is achieved by mapping Cyber Threat Intelligence (CTI) to the Factor Analysis of Information Risk (FAIR) model, enriched by cyber cost typologies. CYREM-ORM provides a traceable workflow that links organisation-related CTI to FAIR factor estimation, cost breakdowns, and ultimately to monetary loss amounts and prioritised risk scenarios. This design improves transparency in risk management, helps organisations prioritise mitigations in line with strategic business objectives, and enables stakeholders to assess the rationale behind results when needed. By grounding risk parameters in CTI, the model also facilitates proactive screening of organisation-relevant threats, instead of reactive, control-gap reporting. We evaluate the CYREM-ORM through three complementary case studies: the 2017 Equifax breach case proves its feasibility with historical data and open-source CTI, while the Small and Medium Enterprise (SME) education company and the large retail company cases show its effectiveness in communicating cyber risks at an organizational-wide strategic level within real-world contexts.

In microtask crowdsourcing, Human Intelligence Tasks (HITs) are commonly allocated on a first-come, first-served basis: they are published on the platform and the fastest workers select the most attractive ones first. This step has not received much attention from the scientific community yet, though it can become particularly taxing for workers when they compete to secure the most sought-after tasks. There are many strategies to ensure one's access to tasks and their effects on the labour process as a whole are not well understood. For instance, platforms with a sizeable task reservation queue allow workers to gain preferential access to a large number of tasks, which in turn may cause a shortage of work for the rest of the crowd. For the requesters, this means lower rates of completion and a lack of worker diversity. We explore workers' strategies for accessing and reserving tasks using monitoring techniques from both client and server sides. We investigate how these strategies affect task execution, in terms of availability, completion time, and answer quality, by deploying 1000 image annotation HITs in Amazon Mechanical Turk including objective and subjective tasks. We observe that workers who do not use automated catching techniques tend to have higher annotation quality, are more focused, spend more effort on text editing, and provide a higher diversity of output than workers using such tools. This study also reveals the tragedy of the commons effect among platform members due to the use of catching techniques: workers using automated catching techniques reserve and complete a substantially higher portion of the available tasks, but the over-reservation of HITs restricts all workers of reservation opportunities, and compromise their own future labour capacity as well. We observe a high inefficiency in job completions, as the majority of the times a task is being reserved by a worker, it will not get actually performed and will need to be republished for further allocation. Finally, we propose solutions to mitigate the negative effects of these phenomena on the labour process.

The increasing sophistication of cyberattacks and the evolution of security risks make it challenging for organizations to understand their impact on businesses.The habitual reliance on the judgment of cyber security experts and communication gaps between cyber security team and board members, responsible for making strategic cyber security investment decisions further weaken organization's capability to respond to cyber threats.Existing research lacks a transparent approach to quantify security risks and their impact on businesses.This paper introduces a novel CYSEM that express security risk in financial terms, through integrating Cyber Threat Intelligence (CTI) with the Factor Analysis of Information Risk (FAIR) model, elaborated with cyber security cost typologies.CYSEM facilitates communication among multi-stakeholders and improves transparency and quality of investment decision-making at the strategic level.We evaluate the CYSEM using a case study, which has showed its effectiveness in understanding the impact of cyber threat from an economics perspective. CCS Concepts• Security and privacy → Human and societal aspects of security and privacy; Economics of security and privacy.

Technologies support our everyday lives, and to ensure that people are not routinely excluded they must be usable by the wider population. However, technologies are not commonly tested with participants from a range of backgrounds. This paper reports on interviews and roundtable discussions with people whose identities can be underrepresented in usability testing and usability researchers to discuss how equality, diversity and inclusion (EDI) can be embedded in usability testing. Key findings include (1) when people participate in research they need a sense of value, trust and agency, and (2) challenges for researchers for embedding EDI in usability testing include organisational pressures, stakeholder culture, getting guidance and recruiting who you need. Recommendations are made to researchers, and to the organisations that employ them. Additionally, we propose a research agenda for a community of users, creators of services and products, usability researchers, and all those advocating for EDI in usability research.

The adoption of blockchain technology is taking place at a fast pace. Security features inherent in blockchain make it resistant to attack, but they do not make it immune, and blockchain security risks do exists. This paper details the associated risks and concerns of the blockchain. We explore relevant standards and regulations related to blockchain and survey and analyze 38 blockchain incidents to determine the root cause to provide a view of the most frequent vulnerabilities exploited. The paper reviews six of these 38 incidents in greater detail. The selection is made by choosing incidents with the most frequent root cause. In the review of the incidents, the paper details what happened and why and aims to address what could have been done to mitigate the attack. The paper concludes with a recommendation on a framework to reduce cyber security risks when using blockchain technologies.