Search

Begin New Search Topic Cybersecurity Political Geography D.C.

1. Classifying Cyber Events: A Proposed Taxonomy

Author:
Charles Harry and Nancy Gallagher
Publication Date:
02-2018
Content Type:
Working Paper
Institution:
Center for International and Security Studies at Maryland (CISSM)
Abstract:
Publicity surrounding the threat of cyber-attacks continues to grow, yet immature classification methods for these events prevent technical staff, organizational leaders, and policy makers from engaging in meaningful and nuanced conversations about the risk to their organizations or critical infrastructure. This paper provides a taxonomy of cyber events that is used to analyze over 2,431 publicized cyber events from 2014-2016 by industrial sector. Industrial sectors vary in the scale of events they are subjected to, the distribution between exploitive and disruptive event types, and the method by which data is stolen or organizational operations are disrupted. The number, distribution, and mix of cyber event types highlight significant differences by sector, demonstrating that strategies may vary based on deeper understandings of the threat environment faced across industries. EXPLORE:
Topic:
Security, Science and Technology, and Cybersecurity
Political Geography:
United States, Washington, and D.C.

2. Categorizing and Assessing the Severity of Disruptive Cyber Events

Author:
Nancy Gallagher and Charles Harry
Publication Date:
04-2017
Content Type:
Working Paper
Institution:
Center for International and Security Studies at Maryland (CISSM)
Abstract:
Faced with a rapidly growing volume and range of cyber attacks, policymakers and organizational leaders have had difficulty setting priorities, allocating resources, and responding effectively without a standard way to categorize cyber events and estimate their consequences. Presidential Policy Directive 41 laid out the Obama administration’s principles for executive branch responses to significant cyber incidents in the public or private sector. But it neither drew important distinctions between different types of cyber incidents, nor gave a standard way to determine where a particular incident falls on its 0-5 point severity scale. This policy brief demonstrates how an analytical framework developed at the Center for International and Security Studies at the University of Maryland (CISSM) can help address these problems. It first differentiates between low-level incidents and more significant cyber events that result in either exploitation of information and/or disruption of operations. It categorizes five types of disruptive events and analyzes 2,030 cyber events in a dataset developed from media sources, showing that cyber exploitation remains more common than disruption, and that most disruptive activity fits into two categories: message manipulation and external denial of service attacks. Finally, the brief offers a standard method to assess the severity of different categories of disruptive attacks against different kinds of organizations based on the scope, magnitude, and duration of the event. This Cyber Disruption Index (CDI) is then applied to survey data on Distributed Denial of Service (DDoS) attacks in the private sector to assess severity within a common category of disruptive events. Of 3,900 cases reported, only 5 events (less than 1% of the DDoS cases) had a combined scope, magnitude, and duration severe enough to be a priority for prevention and potentially warrant government involvement.
Topic:
Government, Cybersecurity, and Media
Political Geography:
United States, Washington, and D.C.

3. Against the Odds Driving Defense Innovation in a Change-Resistant Ecosystem

Author:
Jeffrey P. Bialos, Christine E. Fisher, and Stuart L. Koehl
Publication Date:
02-2017
Content Type:
Special Report
Institution:
Center for Transatlantic Relations
Abstract:
Generating the innovation to sustain the United States’ technology-based military superiority will, of necessity, be a core element of defense strategy for the Trump Administration. This paper identifies the challenges faced by the DoD’s large, multi-faceted research and development ecosystem in meeting that national security goal, and proposes a holistic and balanced strategy for addressing them. Fundamentally, the outgoing Obama Administration concluded that the U.S. military dominance against our near-peer adversaries is eroding in a globalized environment where commercial innovation is not only being rapidly generated through agile and fast-paced processes but is being rapidly disseminated globally and therefore available to potential adversaries. In contrast, the DoD faces the challenge of building a future force that is second to none while using internal processes that generally are overly cumbersome, somewhat antiquated and slower—processes which constrain its ability to access all available innovation, commercial and otherwise, and to rapidly transition that technology to the war fighter in order to produce robust effects on the battlefield. Notwithstanding years of studies that have highlighted well known institutional obstacles to change in both our defense R&D ecosystem and the Department more broadly, these challenges still largely remain. Numerous DoD initiatives to address these issues and incentivize change unfortunately have not moved the needle.
Topic:
Defense Policy, Economics, Military Strategy, Military Affairs, Cybersecurity, and Military Spending
Political Geography:
United States of America, North America, Washington, and D.C.

4. A Framework for Categorizing Disruptive Cyber Activity and Assessing its Impact

Author:
Charles Harry
Publication Date:
08-2015
Content Type:
Working Paper
Institution:
Center for International and Security Studies at Maryland (CISSM)
Abstract:
While significant media attention has been given to the volume and range of cyber attacks, the inability to measure and categorize disruptive events has complicated efforts of policy makers to push comprehensive responses that address the range of cyber activity. While organizations and public officials have spent significant time and resources attempting to grapple with the complex nature of these threats, a systematic and comprehensive approach to categorize and measure disruptive attacks remains elusive. This paper addresses this issue by differentiating between exploitive and disruptive cyber events, proposes a formal method to categorize five types of disruptive events, and measures their impact along three dimensions of analysis. Scope, magnitude, and duration of disruptive cyber events are analyzed to locate each event on a Cyber Disruption Index (CDI) so organizations and policymakers can estimate the aggregated effect of a malicious act aimed at impacting their operations. Using the five different event classes and the CDI estimation method makes it easier for organizations and policy makers to disaggregate a complex topic, contextualize and process individual threats to their network, target where increased investment can reduce the risk of specific disruptive cyber events, and distinguish between events that represent a private-sector problem from those that merit a more serious public-sector concern.
Topic:
Mass Media and Cybersecurity
Political Geography:
United States, North America, Washington, and D.C.