Cyber risk research impeded by disciplinary barriers

Abstract

Cyber risk encompasses a broad spectrum of risks to digital systems, such as data breaches or full-fledged cyber attacks on the electric grid. Efforts to systematically advance the science of cyber risk must draw upon not only computer science, but also fields such as behavioral science, economics, law, management science, and political science. Yet many scholars believe that they have sufficient understanding of other fields to comprehensively address the inherently cross-disciplinary nature of cyber risk. For example, a statistician might apply Bayesian modeling to predict future cyber events, even though it is not entire clear what bearing historical cyber events have on future ones. Computer scientists might write on data protection laws, yet with little knowledge of legal jurisdiction issues. Such questions of disciplinary ownership, the inability to coordinate across disciplines, and the undefined scope of the problem domain have thus plagued inherently cross-disciplinary cyber risk research. Drawing upon global expertise and challenges from industry, academia, non-profit organizations, and governments, we adapt the classical risk management process to identify core research questions for cyber risk, gaps in knowledge that need to be addressed for advances in security, and opportunities for cross-disciplinary collaboration for each area. While we mention specific disciplines, reflective of our backgrounds, these are not the only ones that should be conducting cyber risk research.

Bridging the Gap Between Ethics and Practice

“…These diverse concerns mean that drawing researchers and practitioners from diverse disciplines is more likely to lead to success [73,35]. These HCAI systems will be well received if they go beyond statements about fairness, transparency, accountability, security, and privacy to support specific practices that raise human self-efficacy, encourage creativity, clarify responsibility, and facilitate social participation.…”

Cyber risk management: History and future research directions

“…Sample period: N/A (7 months) Kamiya et al (2020) Conduct a comprehensive study that systematically evaluates both the likelihood and severity of data breaches as well as identifying the corresponding determinants. Sample period: 2005Sample period: -2017 Panel D: Cyber risk treatmentavoidance Falco et al (2019) Describe designing and using inherently secure systems as a type of risk avoidance. Sample period: N/A Toward the late 1990s, scholars from IT and other related disciplines eventually became aware of the lack of consistency and integrity in cataloging computer security risks and realized the need for a universal framework.…”

An instructional definition and assessment rubric for bioinformatics instruction

“…For example, research has shown that students have little understanding of agreed‐upon definitions in environmental and geographic education 9 and evolutionary biology 10 . Finally, definitional ambiguity in cybersecurity has recently been identified as one of the problems preventing the effective benchmarking of security across and within organizations 11 . In short, understanding definitional contexts is critical to effective STEM instruction 12,13 …”

“…10 Finally, definitional ambiguity in cybersecurity has recently been identified as one of the problems preventing the effective benchmarking of security across and within organizations. 11 In short, understanding definitional contexts is critical to effective STEM instruction. 12,13 Although bioinformatics is frequently described in the literature, to the best of our knowledge, only two definitions of the field have been formally proposed (Table 1).…”