Modeling the Ripple Effects of IT‐Based Incidents on Interdependent Economic Systems

Abstract

The information technology (IT) sector is one of the most critically utilized infrastructures within the U.S. economic system. The IT sector is vulnerable to man-made attacks and it is challenging to assess the consequences of disruptions to the production and delivery of essential IT services to other economic systems. In this paper, we developed a dynamic model based on economic input-output analysis to assess time-varying disruptions on the IT sector over multiple periods. The model is applied in an ex post analysis of an actual denial-of-service (DoS) attack scenario on the IT infrastructure to estimate the consequences propagated to interdependent economic systems. The model uses Bureau of Economic Analysis data to simulate the effects of IT-based incidents and subsequently identify the critically affected economic sectors. Key results of the case study include assessments of ripple effects to vulnerable sectors in the form of inoperability and economic loss measures. An investigation of the DoS attack in year 2000 using the proposed dynamic model revealed significant losses that are consistent with the magnitude of losses from previous studies. Furthermore, the model is capable of depicting the breakdown of losses across various economic sectors, which is a significant improvement relative to previously published results. This research also extends into a multiyear trend analysis (1999)(2000)(2001)(2002)(2003)(2004)(2005)(2006)(2007)(2008)(2009)) to aid in developing policies for reducing the effects of IT risks across the interdependent sectors of the U

Evolution of systems engineering scholarship from 2000 to 2015, with particular emphasis on software

“…Al Kawasmi used the algorithms behind Bitcoin to solve the problem of providing anonymous carbon emissions trades among nations. Two articles modeled economic impacts that result from internet outages and cyber‐attacks, with Ali analyzing which industry sectors would be most affected and Haimes comparing cyber risk in cloud computing to non‐cloud storage. Connelly discussed the economics of biofuels for the aviation sector, suggesting the best technology investments.…”

“…Al Kawasmi considered the Bitcoin business model in part because of its answer to security issues. Ali and Haimes address economic fallout of cyber incidents. Trantham looked specifically at cybersecurity for wind farms.…”

“…Four of the 2015 articles (on virtual worlds, on economies, on economic scenarios, and on wind farms) and none of the articles from 2000, simulated the project, business, or enterprise. An overlapping set of five of the 2015 articles simulated the environment: on a multi‐satellite environment, on carbon emissions, on economies, on the biofuels industry, and on the cyber‐environment of a wind farm, plus one 2000 article on oil spills in the Prince William Sound . The increase in the later year probably results in part from availability of and familiarity with good simulation tools and the computing power to run the software.…”

Integrating household survey with inoperability input–output model of critical infrastructure systems: A case study of Hurricane Sandy

“…Furthermore, we leverage the publicly available "supply use tables" or SUT 4 from the US Bureau of Economic Analysis to evaluate the magnitude and significance of the dependencies of an economic sector with an infrastructure system. This methodology has been demonstrated by Ali and Santos (2015) in assessing the strength of coupling of the industry sectors on the information technology infrastructure. A new feature in this article is the ability to model combinations of simultaneous disruptions to multiple infrastructure systems, in contrast to the single-infrastructure analysis conducted by Ali and Santos (2015).…”

Estimating production losses from disruptions based on stock market returns: Applications to 9/11 attacks, the Deepwater Horizon oil spill, and Hurricane Sandy

“…Studies researching the varied applications of the DIIM have been published since the inception of the model. the recent studies include modelling of economic losses due to man-made attacks on the IT sector (Ali and Santos, 2015), the use of the DIIM to model the losses in regions affected by water shortages and droughts and to identify critical sectors affect due to water shortages (Pagsuyoin and Santos, 2015) and economic losses to industrial sectors and inoperability of sectors due to influenza epidemics causing shortages in the workforce (Santos, May & Haimar, 2013).…”