Search

Begin New Search Topic Cyberspace Publishing Institution Center for Strategic and International Studies (CSIS)

1. Hard Choices in a Ransomware Attack

Author:
Emily Harding and Harshana Ghoorhoo
Publication Date:
09-2022
Content Type:
Special Report
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
Ransomware attacks started as a novelty but have now become a clear and present danger to entities of every size and function. The number of ransomware attacks and the price of demanded ransoms have escalated steeply since 2018. Legislation and policy have not kept up. Policymakers have sought to shape the incentive structure for victims to incentivize defense and disincentivize ransom payments. While they are sympathetic to businesses who fall victim to these attacks, which can sometimes be existentially threatening, few policymakers (or their staff) have ever experienced the shock of an attack firsthand and, as a result, are searching with incomplete information for the right combination of carrots and sticks that will help victims and hurt attackers. This report aims to put the reader in the shoes of the victim—the shocking, powerless moment of realization of a ransomware attack. It walks through a set of decisions that victim must make on their worst day and in the weeks to follow. How well an entity succeeds in navigating that peril depends on decisions made well before an attack, so the report also makes recommendations for both government and industry on how to encourage preparation and simple defensive steps.
Topic:
Security, Science and Technology, Cybersecurity, and Cyberspace
Political Geography:
Global Focus

2. Equity and Diversity in the Nation's Cyber Workforce: Policy Recommendations for Addressing Data Gaps

Author:
Irving Lachow
Publication Date:
04-2022
Content Type:
Special Report
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
U.S.-based businesses and government agencies face a shortage of between 350,000 and 600,000 cybersecurity professionals, and 56 percent of companies believe that their staffing shortfalls put them at moderate or extreme risk. Focusing on diversity, equity, and inclusion (DEI) can help organizations address that shortage by increasing the pool of available talent. Beyond the social good that comes with successful implementation of DEI policies, a 2018 McKinsey & Company report notes that organizations can also realize a positive impact on growth and performance. This is due to improved problem solving and idea generation: “Diverse teams have been shown to be more likely to radically innovate and anticipate shifts in consumer needs and consumption patterns—helping their companies to gain a competitive edge.” These benefits carry over to the cybersecurity realm. A diverse workforce can contribute to a better understanding of user behavior and the ever-evolving threat landscape. Additionally, diverse representation can help organizations identify and address implicit biases that may be impacting their ability to hire and retain talent, develop new products and services, and understand market demand across a broader demographic base. MITRE recently conducted a study, funded by the Hewlett Foundation, that examined the current state of data on the diversity of the nation’s cyber workforce. The results of that study point to a data gap that needs to be addressed
Topic:
Labor Issues, Diversity, Labor Market, Cyberspace, and Equity
Political Geography:
North America and United States of America

3. Creating Accountability for Global Cyber Norms

Author:
James A. Lewis
Publication Date:
02-2022
Content Type:
Special Report
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
The year 2021 saw all UN member states agree in the Open-Ended Working Group (OEWG) on a framework for responsible state behavior in cyberspace, based on norms developed in the United Nations Group of Governmental Experts (GGE) in 2015.1 The OEWG formalized global agreement on the 2015 norms. This consensus agreement means that the framework for responsible state behavior is now politically binding for all member states. Global agreement on the obligations for responsible state behavior is a substantial step forward in building international cybersecurity in a rules-based environment. Unfortunately, international experience since 2015 has shown that agreement on norms, even when politically binding, is by itself not enough to ensure their observation or create stability in cyberspace. This has shifted discussion from what norms are needed to how to build accountability and what to do when norms are ignored. While the norms agreed to by all member states will ultimately reinforce international stability, to make progress, it will be necessary to develop a collective diplomatic strategy to improve the observation of norms and increase accountability when they are ignored. A strategy of sustained engagement and the imposition of consequences is necessary for norms to have effect. Our assumption is that accountability for malicious cyber actions can only be strengthened if there are consequences for a state’s decision not to observe norms. If nothing else, a failure to take action in response to transgressions seems to only encourage opponents. An immediate task is to define the conditions for collective action. There has been an initial and informal agreement among like-minded democratic nations that accountability requires the imposition of consequences for a failure to observe norms, but several issues must be addressed. These include agreement on standards for attribution of the source of a malicious action and agreement on a proportional, lawful, and effective response. A collective approach is essential if efforts to create accountability are to succeed, and any response to a cyber incident will require political heft and sustained engagement.
Topic:
Security, International Cooperation, United Nations, Cybersecurity, Accountability, Transparency, and Cyberspace
Political Geography:
Global Focus

4. Data Protection or Data Utility?

Author:
Alexander Kersten and Issac A. Robinson
Publication Date:
02-2022
Content Type:
Special Report
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
Despite the economic upheaval wrought by the Covid-19 pandemic, the United States is now poised to enter a new period of productivity growth with the widespread deployment of artificial intelligence (AI) technologies. And just as past eras’ technologies have been driven entirely by the consumption of resources such as steam, coal, oil, and natural gas, this AI-driven period will rely on data. Yet, while this data-driven economic growth model has proven benefits to both individuals and firms, it also raises serious concerns over individuals’ data privacy. A key challenge in this regard is to ensure that data is handled securely and that the privacy of American citizens is protected. Because of the regard paid to data protection and privacy over the past decade, the proliferation of digitization has made privacy policy a part of innovation policy. However, until now, policymakers have viewed data use and data protection as trade-offs, with some nations adopting strict control of data flows. These measures have not been effective in practice; strict curbs have stifled innovation while doing relatively little to protect privacy. An alternative is to deploy promising cryptographic software solutions that can enhance privacy while still allowing access to data. This solution not only unlocks the commercial potential of data for use by firms, law enforcement, nonprofits, and researchers but also protects individuals’ privacy. Realizing the benefits of this win-win solution will require further development and widespread adoption of emerging cryptographic software solutions.
Topic:
Science and Technology, Innovation, Cyberspace, and Encryption
Political Geography:
North America and United States of America