An Evidence Quality Assessment Model for Cyber Security Policymaking

Abstract

One key factor underpinning a state's capacity to respond to policy challenges of cybersecurity is the quality of evidence supporting such decision making. As part of this process, policy advisers, essentially a diverse group including everyone from civil servants to elected policy makers, are asked to assess evidence from a mix of sources. Sometimes with little relevant expertise and often in time-critical scenarios, assessing threat, risk and proportionate response based on a mix of official briefings, academic sources, and industry threat reports is a challenge. The imperative of dealing with such issues in a timely fashion presents novel technical and political challenges for policy advisers. In this paper we present a model to help assess the quality of such evidence. The Evidence Quality Assessment Model (EQAM) is essentially a tool to help assess evidence fitness and credibility for use in such decision making. We illustrate the model with a sample of possible evidence sources to demonstrate how different attributes could be used for a comparison. The ultimate goal here is to help resolve potential conflicts and weigh findings and opinions systematically.

Games for Cybersecurity Decision-Making

“…Cybersecurity is "viewed as a niche technical subject requiring a computer science degree just to grapple with its impenetrable jargon" [5]. While technical command of cybersecurity is an acknowledged issue amongst boards [9], policymakers [10], and public [11], it is inadequate measure of effectiveness of cybersecurity games as it overlooks a key factor: decision-making.…”

“…During game-play, information from a wide range of sources is provided to participants, which is a scenario inject. This can include supporting cybersecurity evidence such as technical advisory, media items, non-confidential government or agency reports, confidential intelligence briefing, industry analysis and academic research [10]. Scenario injects can have certain characteristics such as time pressure, escalation, reputation and resource allocation, which challenges decision-making, and are shown in Figure 2.…”