Cybersecurity of Critical Infrastructures: Challenges, Empirical Threat Analytics and Future Resilience Perspectives

References

[1] Aror, T.A. and Mupa, M.N. (2025) “Risk and compliance paper: What role does Artificial Intelligence (AI) play in enhancing risk management practices in corporations?”, World Journal of Advanced Research and Reviews, 27(1), pp. 1072-1080. doi: 10.30574/wjarr.2025.27.1.2607.

[2] Barakabitze, A.A., Ahmad, A., Mijumbi, R. and Hines, A. (2020) “5G network slicing using SDN and NFV: A survey of taxonomy, architectures and future challenges”, Computer Networks, 167, 106984.

[3] CyberSeek (2025) Cybersecurity Supply and Demand Heat Map. Available at: https://www.cyberseek.org/heatmap.html (Accessed: 18 June 2026).

[4] De Alwis, C., Porambage, P., Dev, K., Gadekallu, T.R. and Liyanage, M. (2024) “A survey on network slicing security: Attacks, challenges, solutions and research directions”, IEEE Communications Surveys & Tutorials, 26(1), pp. 534-570. doi: 10.1109/COMST.2023.3312349.

[5] ENISA (2024) ENISA Threat Landscape 2024. European Union Agency for Cybersecurity. Available at: https://www.enisa.europa.eu/ (Accessed: 18 June 2026).

[6] Ferrag, M.A., Maglaras, L., Janicke, H. and Smith, R. (2017) “Deep learning techniques for cyber security intrusion detection: A detailed analysis”, in Proceedings of the 6th International Symposium for ICS & SCADA Cyber Security Research.

[7] GAO (2023) Critical Infrastructure Protection: National Cybersecurity Strategy Needs to Address Information Sharing Performance Measures and Methods, GAO-23-105468. Washington, DC: U.S. Government Accountability Office.

[8] Humayed, A., Lin, J., Li, F. and Luo, B. (2017) “Cyber-physical systems security - A survey”, IEEE Internet of Things Journal, 4(6), pp. 1802-1831. doi: 10.1109/JIOT.2017.2703172.

[9] IBM (2025) Cost of a Data Breach Report 2025. IBM Security and Ponemon Institute. Available at: https://www.ibm.com/reports/data-breach (Accessed: 18 June 2026).

[10] Kaggle (2025) Global Cybersecurity Threats (2015-2024). Available at: https://www.kaggle.com/datasets/atharvasoundankar/global-cybersecurity-threats-2015-2024 (Accessed: 18 June 2026).

[11] Khan, R., Kumar, P., Jayakody, D.N.K. and Liyanage, M. (2020) “A survey on security and privacy of 5G technologies: Potential solutions, recent advancements, and future directions”, IEEE Communications Surveys & Tutorials, 22(1), pp. 196-248. doi: 10.1109/COMST.2019.2933899.

[12] Maglaras, L., Janicke, H. and Ferrag, M.A. (2022) “Cybersecurity of critical infrastructures: Challenges and solutions”, Sensors, 22(14), 5105. doi: 10.3390/s22145105.

[13] Moyo, T.M., Zhuwankinyu, E.K. and Mupa, M.N. (2024) “Leveraging Generative AI for an ethical and adaptive cybersecurity framework in enterprise environments”, Iconic Research and Engineering Journals, 8(6), pp. 654-664.

[14] Nankya, M., Sam, A., Mkandawire, E. and Anagnostopoulos, M. (2023) “Securing industrial control systems: Components, cyber threats and machine learning-driven defence strategies”, Sensors, 23, 8840.

[15] NIST (2024) The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29. Gaithersburg, MD: National Institute of Standards and Technology. doi: 10.6028/NIST.CSWP.29.

[16] Ordonez-Lucena, J., Ameigeiras, P., Lopez, D., Ramos-Munoz, J.J., Lorca, J. and Folgueira, J. (2017) “Network slicing for 5G with SDN/NFV: Concepts, architectures, and challenges”, IEEE Communications Magazine, 55(5), pp. 80-87. doi: 10.1109/MCOM.2017.1600935.

[17] Ten, C.W., Manimaran, G. and Liu, C.C. (2010) “Cybersecurity for critical infrastructures: Attack and defense modeling”, IEEE Transactions on Systems, Man, and Cybernetics - Part A: Systems and Humans, 40(4), pp. 853-865. doi: 10.1109/TSMCA.2010.2048028.

[18] Verizon (2024) 2024 Data Breach Investigations Report. Verizon Business. Available at: https://www.verizon.com/business/resources/reports/dbir/ (Accessed: 18 June 2026).

[19] Yigit, Y., Ferrag, M.A., Sarker, I.H., Maglaras, L.A., Chrysoulas, C., Moradpoor, N. and Janicke, H. (2024) “Critical infrastructure protection: Generative AI, challenges, and opportunities”, arXiv preprint arXiv:2405.04874.

[20] Zhuwankinyu, E.K., Mupa, M.N. and Tafirenyika, S. (2025) “Graph-based security models for AI-driven data storage: A novel approach to protecting classified documents”, World Journal of Advanced Research and Reviews, 26(2), pp. 1108-1124. doi: 10.30574/wjarr.2025.26.2.1631.

@article{1722430,
      author = {Ken Mudzingwa, Stewart Munyaradzi Nyamutswa, Admore Tafadzwa Mugwadzi, Panashe Yolanda Dhegwa, Munashe Naphtali Mupa},
      title = {Cybersecurity of Critical Infrastructures: Challenges, Empirical Threat Analytics and Future Resilience Perspectives},
      journal = {Iconic Research And Engineering Journals},
      year = {2026},
      volume = {10},
      number = {2},
      pages = {2482-2496},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1722430.pdf},
      abstract = {Critical infrastructure now depends on cloud platforms, 5G-enabled connectivity, operational technology, Internet of Things devices and data-intensive service delivery. This convergence has widened the attack surface for essential sectors such as energy, water, telecommunications, healthcare, banking, government and transportation. Building on critical-infrastructure cybersecurity scholarship and using a structured public incident dataset of 3,000 records covering 2015-2024, this paper develops an empirical picture of cyber risk across attack types, industries, countries, vulnerability classes and defensive mechanisms. The analysis shows that the sample records an aggregate estimated financial exposure of USD 151.48 billion, an average incident loss of USD 50.49 million, approximately 1.51 billion affected-user records and a mean resolution time of 36.48 hours. DDoS and phishing appear as the most frequent attack categories, while the IT, banking and healthcare sectors carry the largest incident counts. Heat-map analysis identifies Government-DDoS, Telecommunications-Man-in-the-Middle and IT-Man-in-the-Middle combinations as notable high-risk cells under a composite impact measure combining financial loss, affected users and incident resolution time. Statistical tests show weak direct association between categorical attack labels and loss severity, implying that omitted variables such as asset criticality, control maturity, identity exposure, network segmentation, patch latency, vendor concentration and incident-response capability may be more decisive than sector labels alone. The paper therefore proposes a risk-based Critical Infrastructure Cyber Resilience Framework built around governance, asset visibility, zero-trust identity, vulnerability prioritisation, AI-assisted detection, supply-chain assurance, incident reporting and recovery engineering. The contribution is both empirical and practical: it provides an applied analytics model for prioritising critical-infrastructure cyber risk and a governance architecture aligned with NIST CSF 2.0 and contemporary critical-infrastructure protection requirements.},
      keywords = {critical infrastructure; cybersecurity; 5G security; cloud security; cyber resilience; ransomware; DDoS; vulnerability management; NIST CSF; cyber risk analytics.},
      month = {August},
      doi = {https://doi.org/10.64388/IREV10I2-1722430}
  }