{"id":"https://openalex.org/W4394573296","doi":"https://doi.org/10.1080/23738871.2024.2335461","title":"Evidence-based cybersecurity policy? A meta-review of security control effectiveness","display_name":"Evidence-based cybersecurity policy? A meta-review of security control effectiveness","publication_year":2023,"publication_date":"2023-09-02","ids":{"openalex":"https://openalex.org/W4394573296","doi":"https://doi.org/10.1080/23738871.2024.2335461"},"language":"en","primary_location":{"id":"doi:10.1080/23738871.2024.2335461","doi":"https://doi.org/10.1080/23738871.2024.2335461","is_oa":true,"landing_page_url":"https://doi.org/10.1080/23738871.2024.2335461","pdf_url":"https://www.tandfonline.com/doi/pdf/10.1080/23738871.2024.2335461?needAccess=true","source":{"id":"https://openalex.org/S4210236978","display_name":"Journal of Cyber Policy","issn_l":"2373-8871","issn":["2373-8871","2373-8898"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","jufo-1","norway-1","vabb-shw"],"host_organization":"https://openalex.org/P4310320547","host_organization_name":"Taylor & Francis","host_organization_lineage":["https://openalex.org/P4310320547","https://openalex.org/P4310320449"],"host_organization_lineage_names":["Taylor & Francis","Informa"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cyber Policy","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://www.tandfonline.com/doi/pdf/10.1080/23738871.2024.2335461?needAccess=true","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5080051176","display_name":"Daniel Woods","orcid":"https://orcid.org/0000-0002-8569-1917","observed_orcids":["https://orcid.org/0000-0002-8569-1917"]},"institutions":[{"id":"https://openalex.org/I193260172","display_name":"British University in Dubai","ror":"https://ror.org/00mc18523","country_code":"AE","type":"education","lineage":["https://openalex.org/I193260172"]},{"id":"https://openalex.org/I98677209","display_name":"University of Edinburgh","ror":"https://ror.org/01nrxwf90","country_code":"GB","type":"education","lineage":["https://openalex.org/I98677209"]}],"countries":["AE","GB"],"is_corresponding":true,"raw_author_name":"Daniel W. Woods","raw_affiliation_strings":["Coalition Inc., San Francisco, United States of America","School of Informatics, The British University in Dubai, Dubai, United Arab Emirates","School of Informatics, University of Edinburgh, Edinburgh, United Kingdom"],"raw_orcid":"https://orcid.org/0000-0002-8569-1917","affiliations":[{"raw_affiliation_string":"Coalition Inc., San Francisco, United States of America","institution_ids":[]},{"raw_affiliation_string":"School of Informatics, The British University in Dubai, Dubai, United Arab Emirates","institution_ids":["https://openalex.org/I193260172"]},{"raw_affiliation_string":"School of Informatics, University of Edinburgh, Edinburgh, United Kingdom","institution_ids":["https://openalex.org/I98677209"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5113171902","display_name":"Sezaneh Seymour","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sezaneh Seymour","raw_affiliation_strings":["Coalition Inc., San Francisco, United States of America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Coalition Inc., San Francisco, United States of America","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5080051176"],"corresponding_institution_ids":["https://openalex.org/I193260172","https://openalex.org/I98677209"],"apc_list":null,"apc_paid":null,"fwci":5.6993,"has_fulltext":true,"cited_by_count":31,"citation_normalized_percentile":{"value":0.96188483,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":100},"biblio":{"volume":"8","issue":"3","first_page":"365","last_page":"383"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.0,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cybersecurity-policy","display_name":"cybersecurity policy","score":0.9919999837875366},{"id":"https://openalex.org/keywords/patch-management","display_name":"patch management","score":0.9610000252723694},{"id":"https://openalex.org/keywords/multi-factor-authentication","display_name":"multi-factor authentication","score":0.9990000128746033},{"id":"https://openalex.org/keywords/control-implementation","display_name":"control implementation","score":0.492000013589859},{"id":"https://openalex.org/keywords/risk-based-decision-making","display_name":"risk-based decision making","score":0.7820000052452087},{"id":"https://openalex.org/keywords/national-vulnerability-database","display_name":"National Vulnerability Database","score":0.8190000057220459}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7755679488182068},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.47825518250465393},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.47193214297294617},{"id":"https://openalex.org/C178148461","wikidata":"https://www.wikidata.org/wiki/Q1632136","display_name":"Security controls","level":3,"score":0.44431447982788086},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.41582149267196655},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1080/23738871.2024.2335461","doi":"https://doi.org/10.1080/23738871.2024.2335461","is_oa":true,"landing_page_url":"https://doi.org/10.1080/23738871.2024.2335461","pdf_url":"https://www.tandfonline.com/doi/pdf/10.1080/23738871.2024.2335461?needAccess=true","source":{"id":"https://openalex.org/S4210236978","display_name":"Journal of Cyber Policy","issn_l":"2373-8871","issn":["2373-8871","2373-8898"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","jufo-1","norway-1","vabb-shw"],"host_organization":"https://openalex.org/P4310320547","host_organization_name":"Taylor & Francis","host_organization_lineage":["https://openalex.org/P4310320547","https://openalex.org/P4310320449"],"host_organization_lineage_names":["Taylor & Francis","Informa"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cyber Policy","raw_type":"journal-article"},{"id":"pmh:oai:RePEc:taf:rcybxx:v:8:y:2023:i:3:p:365-383","doi":null,"is_oa":false,"landing_page_url":"http://hdl.handle.net/10.1080/23738871.2024.2335461","pdf_url":null,"source":{"id":"https://openalex.org/S4306401271","display_name":"RePEc: Research Papers in Economics","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I77793887","host_organization_name":"Federal Reserve Bank of St. Louis","host_organization_lineage":["https://openalex.org/I77793887"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},{"id":"pmh:oai:pure.ed.ac.uk:openaire/7de6523c-c2ff-493d-8287-31bb0bf71c29","doi":null,"is_oa":true,"landing_page_url":"https://www.research.ed.ac.uk/en/publications/7de6523c-c2ff-493d-8287-31bb0bf71c29","pdf_url":null,"source":{"id":"https://openalex.org/S4306400321","display_name":"Edinburgh Research Explorer (University of Edinburgh)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I98677209","host_organization_name":"University of Edinburgh","host_organization_lineage":["https://openalex.org/I98677209"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Woods, D W & Seymour, S 2024, 'Evidence-based cybersecurity policy? A meta-review of security control effectiveness', Journal of Cyber Policy, vol. 8, no. 3, pp. 365-383. https://doi.org/10.1080/23738871.2024.2335461","raw_type":"info:eu-repo/semantics/publishedVersion"}],"best_oa_location":{"id":"doi:10.1080/23738871.2024.2335461","doi":"https://doi.org/10.1080/23738871.2024.2335461","is_oa":true,"landing_page_url":"https://doi.org/10.1080/23738871.2024.2335461","pdf_url":"https://www.tandfonline.com/doi/pdf/10.1080/23738871.2024.2335461?needAccess=true","source":{"id":"https://openalex.org/S4210236978","display_name":"Journal of Cyber Policy","issn_l":"2373-8871","issn":["2373-8871","2373-8898"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","jufo-1","norway-1","vabb-shw"],"host_organization":"https://openalex.org/P4310320547","host_organization_name":"Taylor & Francis","host_organization_lineage":["https://openalex.org/P4310320547","https://openalex.org/P4310320449"],"host_organization_lineage_names":["Taylor & Francis","Informa"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cyber Policy","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, justice, and strong institutions","score":0.4399999976158142,"id":"https://metadata.un.org/sdg/16"},{"display_name":"Good health and well-being","score":0.428600013256073,"id":"https://metadata.un.org/sdg/3"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4394573296.pdf","grobid_xml":"https://content.openalex.org/works/W4394573296.grobid-xml"},"referenced_works_count":39,"referenced_works":["https://openalex.org/W1966182711","https://openalex.org/W2038348645","https://openalex.org/W2062493711","https://openalex.org/W2083147302","https://openalex.org/W2127183333","https://openalex.org/W2149137922","https://openalex.org/W2158894011","https://openalex.org/W2230817826","https://openalex.org/W2468802342","https://openalex.org/W2495872080","https://openalex.org/W2679033717","https://openalex.org/W2744457088","https://openalex.org/W2748245824","https://openalex.org/W2767011015","https://openalex.org/W2780407070","https://openalex.org/W2784011345","https://openalex.org/W2800686740","https://openalex.org/W2811275589","https://openalex.org/W2914845368","https://openalex.org/W2936357463","https://openalex.org/W2941175079","https://openalex.org/W2948072163","https://openalex.org/W2967263059","https://openalex.org/W2980730236","https://openalex.org/W2990292214","https://openalex.org/W3011448953","https://openalex.org/W3122267592","https://openalex.org/W3125405799","https://openalex.org/W3134966463","https://openalex.org/W3136969503","https://openalex.org/W3156588337","https://openalex.org/W4220830999","https://openalex.org/W4224994991","https://openalex.org/W4246202387","https://openalex.org/W4287119136","https://openalex.org/W4367701276","https://openalex.org/W4383896719","https://openalex.org/W4387999398","https://openalex.org/W4389626540"],"related_works":["https://openalex.org/W7160837832","https://openalex.org/W2975091912","https://openalex.org/W4409738085","https://openalex.org/W3110793982","https://openalex.org/W4313479484","https://openalex.org/W4229016467","https://openalex.org/W3195509753","https://openalex.org/W3194133951","https://openalex.org/W4229075398","https://openalex.org/W4401360857"],"abstract_inverted_index":{"Cybersecurity":[0],"policy":[1,135,169],"should":[2,150],"guide":[3],"firms":[4],"towards":[5],"implementing":[6],"the":[7,55,68,173,182,189],"most":[8,72],"effective":[9,73,95],"security":[10,157],"controls":[11,25,140,158],"and":[12,22,38,63,70,87,159,188],"procedures.":[13],"However,":[14],"there":[15],"is":[16,33,115,121,132],"no":[17],"authority":[18],"that":[19,52,137,171],"collects":[20],"evidence":[21,29,112],"ranks":[23],"cybersecurity":[24,58],"by":[26,31,117,125],"efficacy.":[27],"The":[28,111],"needed":[30],"policymakers":[32,149],"distributed":[34],"across":[35,108],"academic":[36],"studies":[37,51],"industry":[39],"white":[40],"papers.":[41],"To":[42],"address":[43],"this":[44],"gap,":[45],"we":[46],"conduct":[47],"a":[48,119,126],"meta-review":[49],"of":[50,57,175],"empirically":[53],"evaluate":[54],"efficacy":[56,104],"interventions.":[59,74],"Attack":[60],"surface":[61],"management":[62],"patch":[64,176],"cadence":[65],"were":[66],"consistently":[67],"first":[69],"second":[71],"Reduced":[75],"cyber":[76],"insurance":[77],"claims":[78],"frequency":[79],"was":[80,94],"associated":[81],"with":[82],"migrating":[83],"to":[84,143,152],"cloud":[85],"email":[86],"avoiding":[88],"specific":[89,139],"VPN":[90],"providers.":[91],"Multi-factor":[92],"authentication":[93],"in":[96,145,155,168],"protecting":[97],"individual":[98],"accounts,":[99],"although":[100],"inconsistent":[101],"MFA-implementation":[102],"undermines":[103],"when":[105],"rolled":[106],"out":[107],"an":[109],"organisation.":[110],"suggests":[113],"effectiveness":[114],"driven":[116],"how":[118],"control":[120],"implemented":[122],"more":[123],"than":[124],"binary":[127],"yes-no":[128],"regarding":[129],"whether":[130],"it":[131],"implemented.":[133],"Thus,":[134],"measures":[136,170],"mandate":[138],"are":[141],"unlikely":[142],"result":[144],"risk":[146],"reduction.":[147],"Instead,":[148],"aim":[151],"support":[153],"organisations":[154],"administering":[156],"making":[160],"risk-based":[161],"decisions.":[162],"Successful":[163],"examples":[164],"can":[165],"be":[166],"seen":[167],"improve":[172],"efficiency":[174],"management,":[177],"such":[178],"as":[179],"funding":[180],"for":[181],"US":[183],"National":[184],"Vulnerability":[185],"Database,":[186],"CERT/CC,":[187],"Known":[190],"Exploited":[191],"Vulnerabilities":[192],"catalog.":[193]},"counts_by_year":[{"year":2026,"cited_by_count":18},{"year":2025,"cited_by_count":8},{"year":2024,"cited_by_count":5}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2024-04-09T00:00:00"}