How to Measure Cyber-Resilience of a System With Autonomous Agents: Approaches and Challenges

Abstract

Several approaches have been used to assess the performance of cyberphysical systems and their exposure to various types of risks. Such assessments have become increasingly important as autonomous attackers ramp up the frequency, duration and intensity of threats while autonomous agents have the potential to respond to cyber-attacks with unprecedented speed and scale. However, most assessment approaches have limitations with respect to measuring cyber resilience, or the ability of systems to absorb, recover from, and adapt to cyberattacks. In this paper, we provide an overview of several common approaches, discuss practical challenges and propose research directions for the development of effective cyber resilience measures.

Organisational Cyber Resilience: Management Perspectives

“…While no scholarly framework of cyber resilience's organisational factors and strategies was identified by the authors, the Cyber Resilience Matrix (Linkov et al, 2013b) is more comprehensive than other frameworks, with the exception of the complex Shapiro et In an extensive review of resilience, Linkov and Trump (2019) referred to the "resilience matrix" in Chapter Six, and illustrated it in Chapter Eight. Another review of different approaches to measure the cyber resilience of autonomous agents discussed the Matrix as a qualitative approach (Ligo et al, 2021).…”

Editorial

“…The penultimate article in this issue of EMR focuses on a specific type of organizational project-enterprise information security, which Li and colleagues, the authors of this article, say, which is a systematic and transformational project. Information and cybersecurity are major issues and have been covered in the pages of EMR and include the identification of concerns [24], tools for managing cybersecurity [24], and assessment models [25].…”

Space Cyber Threats and Need for Enhanced Resilience of Space Assets

“…The concept of cyber resilience is similar than the general definition of resilience in other disciplines (Ligo, Kott & Linkov, 2021). Its one general definition includes four abilities: plan or prepare for, absorb, recover from, and adapt to known threats (National Academy of Sciences, 2012).…”

“…Linkov et al ( 2013) combine those abilities with cyber system metrics on four domains (Alberts, 2002), as shown in Figure 2: (1) physical resources and the capabilities and the design of those resources, (2) information and information development about the physical domain, (3) cognitive use of the information and physical domains to make decisions, and (4) the social structure and communication for making cognitive decisions. Cyber resilience of a system can be appreciated only when adequate resilience measures are defined and implemented (Ligo et al, 2021). The process of building resilience is a collective action of public and private stakeholders responding to infrastructure disruptions (Heinimann & Hatsector, 2017).…”