Harnessing GPT-4 for generation of cybersecurity GRC policies: A focus on ransomware attack mitigation

Simple item page
dc.citation.volume134
dc.contributor.authorMcIntosh T
dc.contributor.authorLiu T
dc.contributor.authorSusnjak T
dc.contributor.authorAlavizadeh H
dc.contributor.authorNg A
dc.contributor.authorNowrozy R
dc.contributor.authorWatters P
dc.date.accessioned2024-10-25T02:24:18Z
dc.date.available2024-10-25T02:24:18Z
dc.date.issued2023-11-01
dc.description.abstractThis study investigated the potential of Generative Pre-trained Transformers (GPTs), a state-of-the-art large language model, in generating cybersecurity policies to deter and mitigate ransomware attacks that perform data exfiltration. We compared the effectiveness, efficiency, completeness, and ethical compliance of GPT-generated Governance, Risk and Compliance (GRC) policies, with those from established security vendors and government cybersecurity agencies, using game theory, cost-benefit analysis, coverage ratio, and multi-objective optimization. Our findings demonstrated that GPT-generated policies could outperform human-generated policies in certain contexts, particularly when provided with tailored input prompts. To address the limitations of our study, we conducted our analysis with thorough human moderation, tailored input prompts, and the inclusion of legal and ethical experts. Based on these results, we made recommendations for corporates considering the incorporation of GPT in their GRC policy making.
dc.description.confidentialfalse
dc.edition.editionNovember 2023
dc.identifier.citationMcIntosh T, Liu T, Susnjak T, Alavizadeh H, Ng A, Nowrozy R, Watters P. (2023). Harnessing GPT-4 for generation of cybersecurity GRC policies: A focus on ransomware attack mitigation. Computers and Security. 134.
dc.identifier.doi10.1016/j.cose.2023.103424
dc.identifier.eissn1872-6208
dc.identifier.elements-typejournal-article
dc.identifier.issn0167-4048
dc.identifier.number103424
dc.identifier.urihttps://mro.massey.ac.nz/handle/10179/71852
dc.languageEnglish
dc.publisherElsevier B.V.
dc.publisher.urihttps://www.sciencedirect.com/science/article/pii/S0167404823003346
dc.relation.isPartOfComputers and Security
dc.rights(c) 2023 The Author/s
dc.rightsCC BY-NC-ND 4.0
dc.rights.urihttps://creativecommons.org/licenses/by-nc-nd/4.0/
dc.subjectGPT
dc.subjectCybersecurity policies
dc.subjectRansomware
dc.subjectPolicy generation
dc.subjectGRC
dc.titleHarnessing GPT-4 for generation of cybersecurity GRC policies: A focus on ransomware attack mitigation
dc.typeJournal article
pubs.elements-id480791
pubs.organisational-groupOther
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
Published version.pdf
Size:
912.31 KB
Format:
Adobe Portable Document Format
Description:
480791 PDF.pdf
Download
License bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
license.txt
Size:
9.22 KB
Format:
Plain Text
Description:
Download
Collections
Journal Articles