Resilience of Cyber Systems with Over‐ and Underregulation

Abstract

Recent cyber attacks provide evidence of increased threats to our critical systems and infrastructure. A common reaction to a new threat is to harden the system by adding new rules and regulations. As federal and state governments request new procedures to follow, each of their organizations implements their own cyber defense strategies. This unintentionally increases time and effort that employees spend on training and policy implementation and decreases the time and latitude to perform critical job functions, thus raising overall levels of stress. People's performance under stress, coupled with an overabundance of information, results in even more vulnerabilities for adversaries to exploit. In this article, we embed a simple regulatory model that accounts for cybersecurity human factors and an organization's regulatory environment in a model of a corporate cyber network under attack. The resulting model demonstrates the effect of under- and overregulation on an organization's resilience with respect to insider threats. Currently, there is a tendency to use ad-hoc approaches to account for human factors rather than to incorporate them into cyber resilience modeling. It is clear that using a systematic approach utilizing behavioral science, which already exists in cyber resilience assessment, would provide a more holistic view for decisionmakers.

IoT Vulnerability Data Crawling and Analysis

“…Knowing the characteristics and behavior of devices in an IoT infrastructure is a necessary requirement for an effective implementation of cyber security and resilience strategy [24], [27]. In this work we identified the most critical class of vulnerabilities for IoT infrastructure whose information is gathered by the crawler.…”

Resilience of Critical Infrastructures: Review and Analysis of Current Approaches

“…In addition, the metrics must be sensitive, robust (repeatable and reproducible), and permit the representation of uncertainties inherent in resilience evaluations. Measures of resilience do not generally include the temporal dimension (Francis & Bekera, ), but several recent works have indicated the importance of integrating this aspect in the definition of resilience (Gay & Sinha, ) and dynamic formulations started to be proposed (Ganin et al., ; Gao, Barzel, & Barabási, ; Gisladottir, Ganin, Keisler, Kepner, & Linkov, ). Finally, metrics must be presented carefully and take different forms, i.e., tables, maps, curves, etc., and they must be cost effective (Vinchon et al., ).…”

“…In the articles selected for our survey, network/graph‐theory‐based and numerical optimization approaches notably aim at optimizing design to improve the resilience of concerned infrastructures. Very recent works have proposed network‐science‐based frameworks to operationalize resilience of infrastructures (Ganin et al., ; Gao et al., ; Gisladottir et al., ): they rely on the definition of a single universal dynamic resilience function (called critical functionality in Ganin et al. () and Gisladottir et al.…”

“…() and Gisladottir et al. ()) combined with network theory approaches. They are particularly well‐suited to multidimensional systems consisting of a large number of components that interact through a complex network such as CIs in a given territory.…”

Decision‐Making Analytics Using Plural Resilience Parameters for Adaptive Management of Complex Systems

“…The topic of resilience has been studied across a wide variety of disciplines. For example, ecosystems (Holling, ; Hughes et al., ), social systems (Adger, ; López‐Cuevas, Ramírez‐Márquez, Sanchez‐Ante, & Barker, ), infrastructure (Bruneau et al., ; Zobel, ), economies (Rose, ), cyber systems (Gisladottir, Ganin, Keisler, Kepner, & Linkov, ), and many others. Typical engineering system definitions rely on the understanding of robustness, rapidity, resourcefulness, and redundancy for the system following disruption (Bruneau et al., ).…”