Integration of Effort: Securing Critical Infrastructure from Cyberattack

Abstract

Securing privately owned critical infrastructure from cyberattacks poses a novel challenge for the modern regulatory state. In this domain, the interests of the government are only partly aligned with those of nongovernmental owner-operators, necessitating some sort of state action. However, because (1) security conditions change swiftly and (2) the information and tools necessary for effective planning and response are distributed across the private and public sectors, standard regulatory tools are unlikely to produce security. "Integration of effort," which involves intensive strategic and operational collaboration between systemically important firms and the government, is a more promising approach. Evidence for Practice• The dominant U.S. approach to cybersecurity for critical infrastructure-"voluntary partnership" between industry and government-is inadequate to the objective of ensuring continuity of operations. • Cybersecurity mandates aimed at private owner-operators of critical infrastructure, which have been contemplated by successive Administrations and Congress-would prove cumbersome, costly, and ineffective. • The best approach for protecting critical infrastructures against well-resourced threat actors (such as foreign nation-states) is "integration of effort." This model would leverage the distinctive capabilities and authorities of private owner-operators and the government to efficiently (1) identify vulnerabilities and threats; (2) steer investment toward where it is most needed; and (3) prevent, disrupt, or mitigate the damage from cyberattacks on critical systems. One institutional instantiation of integration of effort is a joint "war room" that includes representatives of the relevant federal agencies and a few dozen systemically.

Public Administration for a New Season: Reflecting on Neglected Rural Concerns

“…They suggest that a city's innovative ecosystem can be enhanced, and in particular by configuring key institutional arrangements. The final viewpoint article by Atkins and Lawson (2022) explores how securing privately owned critical infrastructure from cyberattacks poses a novel challenge for the modern regulatory state; namely, because security conditions change rapidly and the information and tools necessary for planning and response are distributed across sectors. They propose integration of effort —intensive strategic and operational collaboration between systemically important firms and the government—as a more promising approach.…”