Cybersecurity Management for Virtual Private Network (VPN) Applications: A Proposed Framework for the Governance of their Use in the Kingdom of Saudi Arabia
محتوى المقال
الملخص
By using the research process, this study addresses the attitudes of the members of Saudi society towards using Virtual Private Network (VPN) applications and the former’s perceptions of the latter’s concept, security, and privacy, in addition to monitoring their risks to cybersecurity. The main objective of the study is to present a proposed framework for the governance of the use of VPN applications in the Kingdom of Saudi Arabia to strengthen cybersecurity management. To achieve the objectives of the study, the researchers used two methods: the social survey method and the content analysis method. The researchers also relied on the questionnaire tool to collect information from the 455 individuals in the study sample. The study yielded a set of findings, the most important of which are as follows: The use of free VPN applications represents 91% of the sample of the study. Also, the study revealed confusion in perceptions of the actual concept of VPN applications, which may be common among users, and showed a diversity of attitudes and motives for using VPN applications, most of which are related to entertainment. Moreover, the study showed that the study sample individuals had some knowledge about the risks of VPN applications to cybersecurity, although most of them did not use cyber protection means. The study recommended the need to organize and manage the use of VPN applications, conduct an evaluation of VPN applications available on Saudi smartphone stores, and prohibit those which contain security vulnerabilities and malware. The study proposed a framework for the governance of the use of VPN applications in the Kingdom of Saudi Arabia, which comprised three dimensions: legal, organizational and awareness-based dimensions.
الكلمات المفتاحية
Information Security، Cybercrimes، Virtual Private Network (VPN) Applications، Network Security، Cybersecurity، Cybersecurity Governance، Internet Governance، Cybersecurity Management
التنزيلات
المراجع
Q. Zhang, J. Li, Y. Zhang H. Wang and D. Gu, “Oh-Pwn-VPN! Security Analysis of OpenVPN-Based Android Apps,” presented at Int. Conf. Cryptol. Net. Secur., Hong Kong, China, Nov. 30-Dec. 2, 2017, pp. 373-389. doi: 10.1007/978-3-030-02641-7_17.
N. A. Hassan and R. Hijazi, “Online Anonymity,” in Digital Privacy and Security Using Windows, Berkeley, CA, USA: Apress, 2017, ch, 4, pp. 123-194.
National Cybersecurity Authority, Aldawabit Al'asasiah lil'amn Alsybrani [Essential Cybersecurity Controls] Saudi Arabia: National Cybersecurity Authority, 2018. [Online]. Available: https://ega.ee/wp-content/uploads/2019/03/Essential-Cybersecurity-Controls.pdf
M. Otayf and A. Qassem, “Cybersecurity,” 2019, Jazan.
He Ye, “Effectiveness of governance of the global network security,” M.S. thesis, Department of Diplomacy, China Foreign Affairs University, Beijing, China, 2015. [Online]. Available: http://cdmd.cnki.com.cn/Article/CDMD-10040-1015037284.htm.
GO-Globe.com, The State of VPN Usage – Statistics and Trends [Infographic], 2016. [Online]. Available: https://www.go-globe.com/vpn-usage-statistics/ (accessed Feb. 25, 2020).
R. Al Jamal, Muqadimah fi Manahij Albahth fi Aldirasat Al'iielamia [An introduction to research methods in media studies] Cairo, Egypt: Open Education Center-Cairo University, 2019.
A. Fonteneau, Saudi Arabia in 2019: A Year of Digital Growth, 2019. [Online]. Available: https://www.socializeagency.com/2019/01/30/digital-in-2019-saudi-arabia/ (accessed Feb. 10, 2020).
A. L. Comrey and H. B. Lee, A First Course in Factor Analysis, 2nd ed. New York, NY, USA: Psychology Press, 1992. doi: 10.4324/9781315827506.
M. Namara, D. Wilkinson, K. Caine and B. P. Knijnenburg, “Emotional and Practical Considerations Towards the Adoption and Abandonment of VPNs as a Privacy-Enhancing Technology,” in Proc. Priv. Enhanc. Technol., vol. 2020, no. 1, pp. 83-102, Jan. 2020, doi: 10.2478/popets-2020-0006.
A. Pavlicek and F. Sudzina, "Use of virtual private networks (VPN) and proxy servers: Impact of personality and demographics,"in 2018 Int. Conf. Digit. Inf. Manage. (ICDIM), Berlin, Germany, 2018, pp. 108-111, doi: 10.1109/ICDIM.2018.8846991.
A. Jayatilleke and P. Pathirana, "Smartphone VPN App Usage and User Awareness Among Facebook Users,” in 2018 Nat. Inf. Technol. Conf. (NITC), Colombo, 2018, pp. 1-6, doi: 10.1109/NITC.2018.8550081.
M. Ikram, N. Vallina-Rodriguez, S. Seneviratne, M. A. Kaafar and V. Paxson, “An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps,” in IMC’16: Proc. 2016 Internet Meas. Conf., Santa Monica, CA, USA, Nov. 2016, pp. 349-364, doi: 10.1145/2987443.2987471.
F. Donovan, Android security hole could enable attackers to bypass VPN, 2014, Fierce Mobile IT.
S. Tao, “The Effects of Mobile Phone’s VPN Technology on the Network Security,” Netinfo Secur., vol. 2013, no. 6, p. 22, 2013.
R. De Bruin and S. H. von Solms, "Cybersecurity Governance: How can we measure it?," 2016 IST-Africa Week Conf., Durban, 2016, pp. 1-9, doi: 10.1109/ISTAFRICA.2016.7530578.
A. Abo-Seada, “Virtual Private Network (VPN),” (in Arabic), Arab J. Inform. Stud., vol. 1, pp. 111-135, Jul. 2012.
J. M. Stewart, Network Security, Firewalls, and VPNs, 2nd ed. Burlington, MA, USA: Jones & Bartlett Learning, 2014.
A. Karaymeh, M. Ababneh, M. Qasaimeh and M. Al-Fayoumi, "Enhancing Data Protection Provided by VPN Connections over Open WiFi Networks," in 2019 2nd Int. Conf. on new Trends in Comput. Sci. (ICTCS), Amman, Jordan, 2019, pp. 1-6, doi: 10.1109/ICTCS.2019.8923104.
R. Leibovitz, Why Your VPN Service Should Offer an Ad Block Feature, 2019. [Online]. Available: https://securethoughts.com/why-your-vpn-service-should-offer-an-ad-block-feature/ (accessed Apr. 2, 2020).
“VPNs: Access All Website Blocked in the UK,” Comput. Act!ve, vol. 532, pp. 50-57, 2018.
T. Bui, S. Rao, M. Antikainen and T. Aura, “Client-Side Vulnerabilities in Commercial VPNs,” in Secure IT Systems. NordSec 2019. Lecture Notes in Computer Science, vol 11875, A. Askarov, R. R. Hansen and W. Rafnsson, Eds, Cham, Switzerland: Springer, 2019, pp. 103-119, doi: https://doi.org/10.1007/978-3-030-35055-0_7.
C. Cawley, 11 Reasons Why You Need a VPN and What It Is, 2018. [Online]. Available: https://www.makeuseof.com/tag/reasons-to-use-vpn/ (accessed Apr. 2, 2020).
B. Jansen, Why VPN can make your online gaming better, Mar. 2018. [Online]. Available: https://www.technologytimes.pk/2018/03/03/vpn-make-online-gaming-better/
“STOP USING VPNs That Are Unsafe!,” Computer Act!ve, vol. 573, pp. 50-57, 2020.
S-mart.biz. Servizi VPN per Android: oltre il 62% richiede permissioni invadenti esuperflue [VPN services for Android: over 62% request intrusive and superfluous permissions]. Accademiaitalianaprivacy.com. [Online]. Available: https://www.accademiaitalianaprivacy.it/dettaglioNews.asp?id=126 (accessed Mar. 23, 2020).
Saudi Group for Information Assurance (Hemaya), “Smart devices risks and protection,” (in Arabic). [Online]. Available: http://eds.a.ebscohost.com.sdl.idm.oclc.org/eds/detail/detail?vid=2&sid=f7d3ecaf-eb35-4f22-902b-4da8643b1e42%40sessionmgr4007&bdata=JnNpdGU9ZWRzLWxpdmU%3d#db=bsu&AN=94293472 (accessed Mar. 24, 2020).
Cyware, The Essentials of VPN: Is Paid VPN Safer Than Free VPN Service?, 2017. [Online]. Available: https://cyware.com/news/the-essentials-of-vpn-is-paid-vpn-safer-than-free-vpn-service-434029a2 (accessed Mar. 22, 2020).
S. Alexander, Alexander: How to avoid browser hijacking, June 2018. [Online]. Available: https://www.startribune.com/alexander-how-to-avoid-browser-hijacking/485950411/?refresh=true
M. Singhal, “Analysis and Categorization of Drive-By Download Malware Using Sandboxing and Yara Ruleset,” M.S. thesis, Faculty of the Graduate School, The University of Texas, Arlington, TX, USA, May 2019. [Online]. Available: https://rc.library.uta.edu/uta-ir/bitstream/handle/10106/28148/SINGHAL-THESIS-2019.pdf?sequence=1&isAllowed=y
S. Taylor, Free VPN Services – What You Need to Know, 2019. [Online]. Available: https://restoreprivacy.com/vpn/free/ (accessed Mar. 22, 2020).
K. S. Alghathbar and A. N. Alsabih, “An Analytical Study of Saudi Hackers,” (in Arabic), J. Inf. Stud., vol. 10, pp. 243-270, 2011.
J. H. Arishee and S. A. Aldossari, “The role of higher education institutions in promoting a culture of information security in society,” (in Arabic), King Fahad Nat. Lib. J., vol. 24, no. 2, Apr.-Sep. 2018.
R. Wyden and M. Rubio, Wyden and Rubio VPN Letter to DHS, Feb. 2019. [Online]. Available: https://www.wyden.senate.gov/imo/media/doc/020719%20Wyden%20Rubio%20VPN%20Letter%20to%20DHS.pdf (accessed Mar. 24, 2020).
Alwatan, “America warns ... VPN apps are dangerous!,” (in Arabic). [Online]. Available: https://bit.ly/3ex2KR0 (accessed Fab. 10, 2020).
A. Alshalan, S. Pisharody and D. Huang, "A Survey of Mobile VPN Technologies," in IEEE Commun. Surveys Tuts., vol. 18, no. 2, pp. 1177-1196, Secondquarter 2016, doi: 10.1109/COMST.2015.2496624.
W. Allababidi, “Report: ‘Dark Web’ is a looming danger that threatens the Internet sector,” (in Arabic), Aug. 12, 2017. [Online]. Available: https://www.albayan.ae/economy/local-market/2017-08-12-1.3023571
S. Shukla, Virtual Private Network (VPN) | An Introduction, Oct. 2017. [Online]. Available: https://www.geeksforgeeks.org/virtual-private-network-vpn-introduction/ (accessed Mar. 31, 2020)
T. Noir, “Information Governance in the Arab Countries,” in Public and Private Corporate Governance for Economic and Structural Reform, Cairo, Egypt.
Judicial Department, Law to Combat Information Technology Crimes. [Online]. Available: https://www.tra.gov.ae/ar/media-hub/press-releases/2016/8/1/telecommunications-regulatory-authority-issues-statement-on-the-use-of-vpn-to-clarify-media-reports.aspx (accessed Apr. 1, 2020).
Telecommunications Regulatory Authority, Telecommunications Regulatory Authority issues statement on the use of VPN to clarify media reports, Aug. 1, 2016. [Online]. Available: https://www.tra.gov.ae/ar/media-hub/press-releases/2016/8/1/telecommunications-regulatory-authority-issues-statement-on-the-use-of-vpn-to-clarify-media-reports.aspx (accessed Apr. 1, 2020).
A. Senft, J. Dalek, H. Noman and M. Crete-Nishihata, Monitoring Information Controls in Iraq in Reaction to ISIS Insurgency [Transl. Cyber Arabs], June 24, 2014. [Online]. Available: https://bit.ly/3blf0SG (accessed Apr. 1, 2020).
R. Abdul Aziz, Using VPN For Security, 2012. [Online]. Available: https://muscatdaily.com/Archive/Stories-Files/Using-VPN-for-security (accessed Apr. 1, 2020).
A. O’DRISCOLL, Where are VPNs legal and where are the banned?, May 2019. [Online]. Available: https://www.comparitech.com/vpn/where-are-vpns-legal-banned/#Z (accessed Apr. 1, 2020).
D. Reisinger, How VPN Restrictions Imposed by China, Russia Impact Internet Freedom, Aug. 2017. [Online]. Available: eweek.com/security/how-vpn-restrictions-imposed-by-china-russia-impact-internet-freedom.
Oxford Analytic, China cross-border cyber controls undergo shift, 2017. [Online]. Available: https://www.emerald.com/insight/content/doi/10.1108/OXAN-DB224436/full/html
Ministry of Industry and Information Technology, Notice of the Ministry of Industry and Information Technology on Clearing and Regulating the Market of Internet Network Access Services, Jan. 2017. [Online]. Available: http://www.miit.gov.cn/n1146295/n1652858/n1652930/n3757020/c5471946/content.html (accessed Apr. 11, 2020).
Y. Wei, China’s New Cybersecurity Regulations: Analyzing the Ban on VPN Services, Apr. 2017. [Online]. Available: https://jsis.washington.edu/eacenter/2017/04/17/chinas-new-cybersecurity-regulations-analyzing-ban-vpn-services/ (accessed Apr. 2, 2020).
M. Wyciślik-Wilson, Russia orders NordVPN, ExpressVPN, HideMyAss and other VPNs to block numerous sites. [Online]. Available: https://betanews.com/2019/03/29/russia-vpn-blocks/
The Associated Press, Law outlawing use of VPNs comes into effect in Russia, Nov. 2017. [Online]. Available: https://apnews.com/article/0c9b28eae516460082efe3957c175b3c
Communications & Information Technology Commission, The Anti-Cyber Crime Law, 2007. [Online]. Available: https://www.citc.gov.sa/ar/RulesandSystems/CITCSystem/Documents/LA_004_%20A_%20Anti-Cyber%20Crime%20Law.pdf (accessed Apr. 16, 2020).
تفاصيل المقال
هذا العمل مرخص بموجب Creative Commons Attribution-NonCommercial 4.0 International License.