Cryptography and Security
SLIE: A Secure and Lightweight Cryptosystem for Data Sharing in IoT Healthcare Services
Ha Xuan Son, Nguyen Quoc Anh, Phat T. Tran-Truong et al. (+2 more)
The Internet of Medical Things (IoMT) has revolutionized healthcare by transforming medical operations into standardized, interoperable services. However, this service-oriented model introduces significant security vulnerabilities in device management and communication, which are especially critical given the sensitivity of medical data. To address these risks, this paper proposes SLIE (Secure and Lightweight Identity Encryption), a novel cryptosystem based on Wildcard Key Derivation Identity-Based Encryption (WKD-IBE). SLIE ensures scalable trust and secure omnidirectional communication through end-to-end encryption, hierarchical access control, and a lightweight key management system designed for resource-constrained devices. It incorporates constant-time operations,
memory obfuscation, and expiry-based key revocation to counter side-channel, man-in-the-middle, and unauthorized access attacks, thereby ensuring compliance with standards like HIPAA and GDPR. Evaluations show that SLIE significantly outperforms RSA, with encryption and decryption times of 0.936ms and 0.217ms for 1KB of data, an 84.54% improvement in encryption speed, a 99.70% improvement in decryption speed, and an energy efficiency of 0.014 J/KB.
Read the full abstract ▾
All authors Ha Xuan Son, Nguyen Quoc Anh, Phat T. Tran-Truong, Le Thanh Tuan, Pham Thanh Nghiem
Cryptography and Security · Cross-listed from cs.SE
LLM Agents for Automated Web Vulnerability Reproduction: Are We There Yet?
Bin Liu, Yanjie Zhao, Guoai Xu et al. (+1 more)
Large
language model (LLM)
agents have demonstrated remarkable capabilities in software engineering and cybersecurity tasks, including code generation, vulnerability discovery, and automated testing. One critical but underexplored application is automated web vulnerability reproduction, which transforms vulnerability reports into working exploits. Although recent advances suggest promising potential, challenges remain in applying LLM
agents to real-world web vulnerability reproduction scenarios. In this paper, we present the first comprehensive evaluation of state-of-the-art LLM
agents for automated web vulnerability reproduction. We systematically assess 20
agents from software engineering, cybersecurity, and general domains across 16 dimensions, including technical capabilities, environment adaptability, and user experience factors, on 3 representative web vulnerabilities. Based on the results, we select three top-performing
agents (OpenHands, SWE-
agent, and CAI) for in-depth evaluation on our
benchmark dataset of 80 real-world CVEs spanning 7 vulnerability types and 6 web technologies. Our results reveal that while LLM
agents achieve reasonable success on simple library-based vulnerabilities, they consistently fail on complex service-based vulnerabilities requiring multi-component environments. Complex environment configurations and authentication barriers create a gap where
agents can execute exploit code but fail to trigger actual vulnerabilities. We observe high sensitivity to input guidance, with performance degrading by over 33% under incomplete authentication information. Our findings highlight the significant gap between current LLM
agent capabilities and the demands of reliable automated vulnerability reproduction, emphasizing the need for advances in environmental adaptation and autonomous problem-solving capabilities.
Read the full abstract ▾
All authors Bin Liu, Yanjie Zhao, Guoai Xu, Haoyu Wang
Cryptography and Security
FibRace: a large-scale benchmark of client-side proving on mobile devices
Simon Malatrait and Alex Sirac
FibRace, jointly developed by KKRT Labs and Hyli, was the first large-scale experiment to test client-side proof generation on smartphones using Cairo M. Presented as a mobile game in which players proved Fibonacci numbers and climbed a leaderboard, FibRace served a dual purpose: to engage the public and to provide empirical benchmarking. Over a three-week campaign (September 11-30, 2025), 6,047 players across 99 countries generated 2,195,488 proofs on 1,420 unique device models. The results show that most modern smartphones can complete a proof in under 5 seconds, confirming that *mobile devices are now capable of producing zero-knowledge proofs reliably*, without the need for remote provers or specialized hardware. Performance was correlated primarily with RAM capacity and SoC (System on Chip) performance: devices with at least 3 GB of RAM proved stably, when Apple's A19 Pro and M-series chips achieved the fastest proving times. Hyli's blockchain natively verified every proof onchain without congestion. FibRace provides the most comprehensive
dataset to date on mobile proving performance, establishing a practical baseline for future research in lightweight provers, proof-powered infrastructure, and
privacy-preserving mobile applications.
Read the full abstract ▾
Cryptography and Security
AEX-NStep: Probabilistic Interrupt Counting Attacks on Intel SGX
Nicolas Dutly, Friederike Groschupp, Ivan Puddu et al. (+2 more)
To mitigate interrupt-based stepping attacks (notably using SGX-Step), Intel introduced AEX-Notify, an ISA extension to Intel SGX that aims to prevent deterministic single-stepping. In this work, we introduce AEX-NStep, the first interrupt counting attack on AEX-Notify-enabled Enclaves. We show that deterministic single-stepping is not required for interrupt counting attacks to be practical and that, therefore, AEX-Notify does not entirely prevent such attacks. We specifically show that one of AEX-Notify's security guarantees, obfuscated forward progress, does not hold, and we introduce two new probabilistic interrupt counting attacks. We use these attacks to construct a practical ECDSA key leakage attack on an AEX-Notify-enabled SGX enclave. Our results extend the original security analysis of AEX-Notify and inform the design of future mitigations.
Read the full abstract ▾
All authors Nicolas Dutly, Friederike Groschupp, Ivan Puddu, Kari Kostiainen, Srdjan Capkun
Cryptography and Security · Cross-listed from cs.AI
TITAN: Graph-Executable Reasoning for Cyber Threat Intelligence
Marco Simoni, Aleksandar Fontana, Andrea Saracino et al. (+1 more)
TITAN (Threat Intelligence Through Automated
Navigation) is a framework that connects natural-
language cyber threat queries with executable
reasoning over a structured knowledge graph. It integrates a path planner model, which predicts logical relation chains from text, and a graph executor that traverses the TITAN Ontology to retrieve factual answers and supporting evidence. Unlike traditional
retrieval systems, TITAN operates on a typed, bidirectional graph derived from MITRE, allowing
reasoning to move clearly and reversibly between threats, behaviors, and defenses. To support training and evaluation, we introduce the TITAN
Dataset, a corpus of 88209 examples (Train: 74258; Test: 13951) pairing natural
language questions with executable
reasoning paths and step by step Chain of Thought explanations. Empirical evaluations show that TITAN enables models to generate syntactically valid and semantically coherent
reasoning paths that can be deterministically executed on the underlying graph.
Read the full abstract ▾
All authors Marco Simoni, Aleksandar Fontana, Andrea Saracino, Paolo Mori
Cryptography and Security
Improving Cybercrime Detection and Digital Forensics Investigations with Artificial Intelligence
Silvia Lucia Sanna, Leonardo Regano, Davide Maiorca et al. (+1 more)
According to a recent EUROPOL report, cybercrime is still recurrent in Europe, and different activities and countermeasures must be taken to limit, prevent, detect, analyze, and fight it. Cybercrime must be prevented with specific measures, tools, and techniques, for example through automated network and malware analysis. Countermeasures against cybercrime can also be improved with proper \df analysis in order to extract data from digital devices trying to retrieve information on the cybercriminals. Indeed, results obtained through a proper \df analysis can be leveraged to train cybercrime detection systems to prevent the success of similar crimes. Nowadays, some systems have started to adopt Artificial Intelligence (AI)
algorithms for cyberattack detection and \df analysis improvement. However, AI can be better applied as an additional instrument in these systems to improve the detection and in the \df analysis. For this reason, we highlight how cybercrime analysis and \df procedures can take advantage of AI. On the other hand, cybercriminals can use these systems to improve their skills, bypass automatic detection, and develop advanced attack techniques. The case study we presented highlights how it is possible to integrate the use of the three popular chatbots Gemini, Copilot and chatGPT to develop a Python code to encode and decoded images with steganographic technique, even though their presence is not an indicator of crime, attack or maliciousness but used by a cybercriminal as anti-forensics technique.
Read the full abstract ▾
All authors Silvia Lucia Sanna, Leonardo Regano, Davide Maiorca, Giorgio Giacinto
Cryptography and Security
Symbolic verification of Apple's Find My location-tracking protocol
Vaishnavi Sundararajan and Rithwik
Tracking devices, while designed to help users find their belongings in case of loss/theft, bring in new questions about
privacy and surveillance of not just their own users, but in the case of crowd-sourced location tracking, even that of others even orthogonally associated with these platforms. Apple's Find My is perhaps the most ubiquitous such system which can even locate devices which do not possess any cellular support or GPS, running on millions of devices worldwide. Apple claims that this system is private and secure, but the code is proprietary, and such claims have to be taken on faith. It is well known that even with perfect cryptographic guarantees, logical flaws might creep into protocols, and allow undesirable attacks. In this paper, we present a symbolic model of the Find My protocol, as well as a precise formal specification of desirable properties, and provide automated, machine-checkable proofs of these properties in the Tamarin prover.
Read the full abstract ▾
Cryptography and Security
Lexo: Eliminating Stealthy Supply-Chain Attacks via LLM-Assisted Program Regeneration
Evangelos Lamprou, Julian Dai, Grigoris Ntousakis et al. (+2 more)
Software supply-chain attacks are an important and ongoing concern in the open source software ecosystem. These attacks maintain the standard functionality that a component implements, but additionally hide malicious functionality activated only when the component reaches its target environment. Lexo addresses such stealthy attacks by automatically learning and regenerating vulnerability-free versions of potentially malicious components. Lexo first generates a set of input-output pairs to model a component's full observable behavior, which it then uses to synthesize a new version of the original component. The new component implements the original functionality but avoids stealthy malicious behavior. Throughout this regeneration process, Lexo consults several distinct instances of Large
Language Models (LLMs), uses correctness and coverage metrics to shepherd these instances, and guardrails their results. An evaluation on 100+ real-world packages, including high-profile stealthy supply-chain attacks, indicates that Lexo scales across multiple domains, regenerates code efficiently (<30m on average), maintains compatibility, and succeeds in eliminating malicious code in several real-world supply-chain-attacks, even in cases when a state-of-the-art LLM fails to eliminate malicious code when given the source code of the component and prompted to do so.
Read the full abstract ▾
All authors Evangelos Lamprou, Julian Dai, Grigoris Ntousakis, Martin C. Rinard, Nikos Vasilakis
Cryptography and Security
Certifying optimal MEV strategies with Lean
Massimo Bartoletti, Riccardo Marchesin and Roberto Zunino
Maximal Extractable Value (MEV) refers to a class of attacks to decentralized applications where the adversary profits by manipulating the ordering, inclusion, or exclusion of transactions in a blockchain. Decentralized Finance (DeFi) protocols are a primary target of these attacks, as their logic depends critically on transaction sequencing. To date, MEV attacks have already extracted billions of dollars in value, underscoring their systemic impact on blockchain security. Verifying the absence of MEV attacks requires determining suitable upper bounds, i.e. proving that no
adversarial strategy can extract more value (if any) than expected by protocol designers. This problem is notoriously difficult: the space of
adversarial strategies is extremely vast, making empirical studies and pen-and-paper
reasoning insufficiently rigorous. In this paper, we present the first mechanized formalization of MEV in the Lean
theorem prover. We introduce a methodology to construct machine-checked proofs of MEV bounds, providing correctness guarantees beyond what is possible with existing techniques. To demonstrate the generality of our approach, we model and analyse the MEV of two paradigmatic DeFi protocols. Notably, we develop the first machine-checked proof of the optimality of sandwich attacks in Automated
Market Makers, a fundamental DeFi primitive.
Read the full abstract ▾
Cryptography and Security
Stealthy Dual-Trigger Backdoors: Attacking Prompt Tuning in LM-Empowered Graph Foundation Models
Xiaoyu Xue, Yuni Lai, Chenxi Huang et al. (+4 more)
The emergence of graph foundation models (GFMs), particularly those incorporating
language models (LMs), has revolutionized graph learning and demonstrated remarkable performance on text-attributed graphs (TAGs). However, compared to traditional GNNs, these LM-empowered GFMs introduce unique security vulnerabilities during the unsecured
prompt tuning phase that remain understudied in current research. Through empirical investigation, we reveal a significant performance degradation in traditional graph
backdoor attacks when operating in attribute-inaccessible constrained TAG systems without explicit trigger node attribute optimization. To address this, we propose a novel dual-trigger
backdoor attack framework that operates at both text-level and struct-level, enabling effective attacks without explicit optimization of trigger node text attributes through the strategic utilization of a pre-established text pool. Extensive experimental evaluations demonstrate that our attack maintains superior clean accuracy while achieving outstanding attack success rates, including scenarios with highly concealed single-trigger nodes. Our work highlights critical
backdoor risks in web-deployed LM-empowered GFMs and contributes to the development of more robust supervision mechanisms for open-source platforms in the era of foundation models.
Read the full abstract ▾
All authors Xiaoyu Xue, Yuni Lai, Chenxi Huang, Yulin Zhu, Gaolei Li, Xiaoge Zhang, Kai Zhou
Cryptography and Security
Match & Mend: Minimally Invasive Local Reassembly for Patching N-day Vulnerabilities in ARM Binaries
Sebastian Jänich, Merlin Sievers and Johannes Kinder
Low-cost Internet of Things (IoT) devices are increasingly popular but often insecure due to poor update regimes. As a result, many devices run outdated and known-vulnerable versions of open-source software. We address this problem by proposing to patch IoT firmware at the binary level, without requiring vendor support. In particular, we introduce minimally invasive local reassembly, a new technique for automatically patching known (n-day) vulnerabilities in IoT firmware. Our approach is designed to minimize side effects and reduce the risk of introducing breaking changes. We systematically evaluate our approach both on 14 vulnerabilities within the controlled environment of the MAGMA
benchmarks, as well as on 30 real-world Linux-based IoT firmware images from the KARONTE
dataset. Our prototype successfully patches 76% of targeted vulnerabilities in MAGMA and 96% in the firmware
dataset.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.LG
Are My Optimized Prompts Compromised? Exploring Vulnerabilities of LLM-based Optimizers
Andrew Zhao, Reshmi Ghosh, Vitor Carvalho et al. (+4 more)
Large
language model (LLM) systems increasingly power everyday AI applications such as chatbots, computer-use assistants, and autonomous
robots, where performance often depends on manually well-crafted
prompts. LLM-based
prompt optimizers reduce that effort by iteratively refining
prompts from scored feedback, yet the security of this optimization stage remains underexamined. We present the first systematic analysis of poisoning risks in LLM-based
prompt optimization. Using HarmBench, we find systems are substantially more vulnerable to manipulated feedback than to query poisoning alone: feedback-based attacks raise attack success rate (ASR) by up to {\Delta}ASR = 0.48. We introduce a simple fake reward attack that requires no access to the reward model and significantly increases vulnerability. We also propose a lightweight highlighting defense that reduces the fake reward {\Delta}ASR from 0.23 to 0.07 without degrading utility. These results establish
prompt optimization pipelines as a first-class attack surface and motivate stronger safeguards for feedback channels and optimization frameworks.
Read the full abstract ▾
All authors Andrew Zhao, Reshmi Ghosh, Vitor Carvalho, Emily Lawton, Keegan Hines, Gao Huang, Jack W. Stokes
Cryptography and Security
BinCtx: Multi-Modal Representation Learning for Robust Android App Behavior Detection
Zichen Liu, Shao Yang and Xusheng Xiao
Mobile app
markets host millions of apps, yet undesired behaviors (e.g., disruptive ads, illegal redirection, payment deception) remain hard to catch because they often do not rely on permission-protected APIs and can be easily camouflaged via UI or metadata edits. We present BINCTX, a learning approach that builds multi-modal representations of an app from (i) a global bytecode-as-image view that captures code-level semantics and family-style patterns, (ii) a contextual view (manifested actions, components, declared permissions, URL/IP constants) indicating how behaviors are triggered, and (iii) a third-party-library usage view summarizing invocation frequencies along inter-component call paths. The three views are embedded and fused to train a contextual-aware classifier. On real-world malware and benign apps, BINCTX attains a macro F1 of 94.73%, outperforming strong baselines by at least 14.92%. It remains robust under commercial obfuscation (F1 84% post-obfuscation) and is more resistant to
adversarial samples than state-of-the-art bytecode-only systems.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.AI
Terrarium: Revisiting the Blackboard for Multi-Agent Safety, Privacy, and Security Studies
Mason Nakamura, Abhinav Kumar, Saaduddin Mahmud et al. (+3 more)
A multi-
agent system (MAS) powered by large
language models (LLMs) can automate tedious user tasks such as meeting scheduling that requires inter-
agent collaboration. LLMs enable nuanced protocols that account for unstructured private data, user constraints, and preferences. However, this design introduces new risks, including misalignment and attacks by malicious parties that compromise
agents or steal user data. In this paper, we propose the Terrarium framework for fine-grained study on safety,
privacy, and security in LLM-based MAS. We repurpose the blackboard design, an early approach in multi-
agent systems, to create a modular, configurable testbed for multi-
agent collaboration. We identify key attack vectors such as misalignment, malicious
agents, compromised communication, and data poisoning. We implement three collaborative MAS scenarios with four representative attacks to demonstrate the framework's flexibility. By providing tools to rapidly prototype, evaluate, and iterate on defenses and designs, Terrarium aims to accelerate progress toward trustworthy multi-
agent systems.
Read the full abstract ▾
All authors Mason Nakamura, Abhinav Kumar, Saaduddin Mahmud, Sahar Abdelnabi, Shlomo Zilberstein, Eugene Bagdasarian
Cryptography and Security
Beyond a Single Perspective: Towards a Realistic Evaluation of Website Fingerprinting Attacks
Xinhao Deng, Jingyou Chen, Linxiao Yu et al. (+6 more)
Website Fingerprinting (WF) attacks exploit patterns in encrypted traffic to infer the websites visited by users, posing a serious threat to anonymous communication systems. Although recent WF techniques achieve over 90% accuracy in controlled experimental settings, most studies remain confined to single scenarios, overlooking the complexity of real-world environments. This paper presents the first systematic and comprehensive evaluation of existing WF attacks under diverse realistic conditions, including defense mechanisms, traffic drift, multi-tab browsing, early-stage detection, open-world settings, and few-shot scenarios. Experimental results show that many WF techniques with strong performance in isolated settings degrade significantly when facing other conditions. Since real-world environments often combine multiple challenges, current WF attacks are difficult to apply directly in practice. This study highlights the limitations of WF attacks and introduces a multidimensional evaluation framework, offering critical insights for developing more robust and practical WF attacks.
Read the full abstract ▾
All authors Xinhao Deng, Jingyou Chen, Linxiao Yu, Yixiang Zhang, Zhongyi Gu, Changhao Qiu, Xiyuan Zhao, Ke Xu, Qi Li
Cryptography and Security
RHINO: Guided Reasoning for Mapping Network Logs to Adversarial Tactics and Techniques with Large Language Models
Fanchao Meng, Jiaping Gui, Yunbo Li et al. (+1 more)
Modern Network Intrusion Detection Systems (NIDS) generate vast volumes of low-level alerts that remain semantically fragmented, requiring labor-intensive manual correlation with high-level
adversarial behaviors. Existing automation, namely rule-based systems and machine learning classifiers, has critical limitations: rule-based approaches fail to adapt to novel attack variations, while machine learning methods lack contextual awareness and treat tactic-technique (TT) mapping as syntactic matching rather than
reasoning. Although Large
Language Models (LLMs) show promise in cybersecurity, preliminary experiments reveal that existing LLM-based methods frequently hallucinate technique-tactic pairs or produce decontextualized mappings due to single-step classification. We introduce RHINO, a framework that decomposes LLM-based attack analysis into three structured phases: (1) behavioral abstraction, translating raw logs into contextualized narratives; (2) partitioned inference over the ATT&CK tactic space, generating candidate techniques by evaluating behavioral evidence against MITRE ATT&CK knowledge; and (3) knowledge-grounded refinement, cross-referencing predictions with official MITRE definitions to reduce
hallucinations. We evaluate RHINO on three
benchmarks (DAPT2020, CICIDS2017, IoT23) across four backbone models (ChatGPT-4o, Gemini 2.5 Flash, Claude Sonnet 4, and DeepSeek V3). Under a scenario-documented single-label formulation covering 11 distinct techniques, RHINO achieves an average top-1 accuracy of 87.34% under micro-averaging and 63.77% under macro-averaging, surpassing the strongest baseline by 16.78 and 13.60 points respectively. These results show that structured LLM
reasoning can effectively translate low-level network observations into high-level
adversarial behaviors.
Read the full abstract ▾
All authors Fanchao Meng, Jiaping Gui, Yunbo Li, Yue Wu
Cryptography and Security
An Information Asymmetry Game for Trigger-based DNN Model Watermarking
Chaoyue Huang, Gejian Zhao, Hanzhou Wu et al. (+2 more)
As a valuable digital product, deep neural networks (DNNs) face increasingly severe threats to the intellectual property, making it necessary to develop effective technical measures to protect them. Trigger-based watermarking methods achieve copyright protection by
embedding triggers into the host DNNs. However, the attacker may remove the watermark by
pruning or fine-tuning. We model this interaction as a game under conditions of information asymmetry, namely, the defender embeds a secret watermark with private knowledge, while the attacker can only access the watermarked model and seek removal. We define strategies, costs, and utilities for both players, derive the attacker's optimal
pruning budget, and establish an exponential lower bound on the accuracy of watermark detection after attack. Experimental results demonstrate the feasibility of the watermarked model, and indicate that sparse watermarking can resist removal with negligible accuracy loss. This study highlights the effectiveness of game-theoretic analysis in guiding the design of robust watermarking schemes for model copyright protection.
Read the full abstract ▾
All authors Chaoyue Huang, Gejian Zhao, Hanzhou Wu, Zhihua Xia, Asad Malik
Cryptography and Security
Infrastructure Patterns in Toll Scam Domains: A Comprehensive Analysis of Cybercriminal Registration and Hosting Strategies
Morium Akter Munny, Mahbub Alam, Sonjoy Kumar Paul et al. (+3 more)
Toll scams involve criminals registering fake domains that pretend to be legitimate transportation agencies to trick users into making fraudulent payments. Although these scams are rapidly increasing and causing significant harm, they have not been extensively studied. We present the first large-scale analysis of toll scam domains, using a newly created
dataset of 67,907 confirmed scam domains mostly registered in 2025. Our study reveals that attackers exploit permissive registrars and less common top-level domains, with 86.9% of domains concentrated in just five non-mainstream TLDs and 72.9% registered via a single provider. We also discover specific registration patterns, including short bursts of activity that suggest automated, coordinated attacks, with over half of domains registered in the first quarter of 2025. This extreme temporal clustering reflects highly synchronized campaign launches. Additionally, we build a simple predictive model using only domain registration data to predict which scam domains are likely to be suspended – a proxy for confirmed abuse – achieving 80.4% accuracy, and 92.3% sensitivity. Our analysis reveals attacker strategies for evading detection – such as exploiting obscure TLDs, permissive registrars, and coordinated registration bursts – which can inform more targeted interventions by registrars, hosting providers, and security platforms. However, our results suggest that registration metadata alone may be insufficient, and incorporating features from domain URLs and webpage content could further improve detection.
Read the full abstract ▾
All authors Morium Akter Munny, Mahbub Alam, Sonjoy Kumar Paul, Daniel Timko, Muhammad Lutfor Rahman, Nitesh Saxena
Cryptography and Security
Securing U.S. Critical Infrastructure: Lessons from Stuxnet and the Ukraine Power Grid Attacks
Jack Vanlyssel
Industrial Control Systems (ICS) underpin the United States' critical infrastructure, managing essential services such as power, water, and transportation that are vital to national security and public safety. However, increasing digital integration has exposed these systems to escalating cyber threats. Historical attacks like Stuxnet and the Ukraine power grid incident revealed exploitable weaknesses-poor network
segmentation, outdated software, weak authentication, and inadequate monitoring-that persist in many U.S. ICS environments today. This paper analyzes these landmark attacks to identify recurring vulnerabilities and assess their relevance to current U.S. infrastructure. It argues that without immediate reforms, similar exploits could lead to catastrophic disruptions and national security crises. To address these risks, the paper proposes policy measures focused on implementing zero-trust architecture and improved network
segmentation to enhance system resilience. These recommendations aim to guide policymakers and industry leaders in securing the nation's most critical operational technologies against future cyber threats.
Read the full abstract ▾
Cryptography and Security
Power Grid Cybersecurity: Policy Analysis White Paper
Jack Vanlyssel
The U.S. power grid underpins national security, public safety, and economic stability, but faces growing cyber risks from vulnerabilities in industrial control systems, remote access, and poor cyber hygiene. Despite its critical importance, current policy remains fragmented and reactive. This paper proposes a dual policy approach to strengthen grid cybersecurity: enhanced information sharing between government and private utilities to improve threat detection and response, and standardized cyber hygiene practices to reduce common attack vectors. For long-term resilience, a Unified National Cybersecurity Framework is recommended to align existing NERC, IEC, IEEE, and NIST standards, eliminate regulatory overlap, and adapt to evolving threats. Together, these policies offer both immediate and sustainable improvements in safeguarding the nation's most vital infrastructure.
Read the full abstract ▾