Cybersecurity, trustworthiness and resilient systems: guiding values for policy

Abstract

Cyberspace relies on information technologies to mediate relations between different people, across different communication networks and is reliant on the supporting technology. These interactions typically occur without physical proximity and those working depending on cybersystems must be able to trust the overall human-technical systems that support cyberspace. As such, detailed discussion of cybersecurity policy would be improved by including trust as a key value to help guide policy discussions. Moreover, effective cybersystems must have resilience designed into them. This paper argues that trustworthy cybersystems are a key element to resilient systems, and thus are core to cybersecurity policy. The paper highlights the importance of trustworthiness for resilient cybersystems. The importance of trustworthiness is shown through a discussion of three events where trustworthiness was the target or casualty of cyberattacks: Stuxnet, hacking of communications and the Edward Snowden revelations. The impact of losing trust is highlighted, to underpin the argument that a resilient cybersystem ought to design in trustworthiness. The paper closes off by presenting a general set of policy implications arising from recognition of the interplay between trust, trustworthiness and resilience for effective cybersecurity.

Terrorism and the Internet of Things: Cyber-Terrorism as an Emergent Threat

“…The underpinning factor of how successful IoT enabled cyber-terrorism is, is how resilient the system is to such attacks [27,28]. By recognising that the IoT is a potential enabler for cyber-terrorism, we are part of the way to reducing the impact of such attacks.…”

Review of cybersecurity frameworks: context and shared concepts

“…The steep rise of digital activity in modern life has created the need for strong cyber resilience. One important aspect of developing such resilience is the creation of cybersecurity policies (CSPs) that are able to coordinate and reinforce the efforts of a range of stakeholders (Henschke and Ford 2016;Pawlak and Barmpaliou 2017;Tiirmaa-Klaar 2016). Guiding policymakers in the development of CSPs are cybersecurity frameworks (CSFs).…”