Search

Begin New Search Topic Military Strategy Author Nancy Gallagher

1. An Effects-Centric Approach to Assessing Cybersecurity Risk

Author:
Charles Harry and Nancy Gallagher
Publication Date:
03-2019
Content Type:
Working Paper
Institution:
Center for International and Security Studies at Maryland (CISSM)
Abstract:
Faced with rapidly growing cyber threats, organizational leaders, and government officials cannot reliably secure all data and digital devices for which they are responsible. The best they can do is conduct strategic risk management. That requires a systematic way to categorize potential attacks and estimate consequences in order to set priorities, allocate resources, and mitigate losses. The 2018 U.S. National Cyber Strategy holds government officials accountable for doing cyber risk management based on the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework and recommendations from not-for-profit organizations such as the Center for Internet Security (CIS) and ISACA. Yet, none of these policy documents and best practice guides actually provide the necessary analytical tools. As a result, public agencies, private companies, and non-profit groups that try to do risk assessment often feel overwhelmed rather than empowered to make strategic cybersecurity decisions. The Center for International and Security Studies at Maryland (CISSM) has developed an analytical framework that provides four essential building blocks needed to satisfy the principles in the NIST Standard Framework and other best practice guides: 1. A standardized system for classifying cyber threats and events by their effects. 2. Tools to associate organizational functions with IT topologies. 3. Algorithms to assess the severity of disruptive and exploitative cyber events. 4. A method to understand the integrated nature of risk across different parts of a simple organization, major divisions of a complex organization, or interconnected organizations in a complex system. These building blocks can be combined in different ways to answer critical questions, such as: • What is the range of cyber risks to different types of organizations? • Which threats pose the greatest risk to a specific department or organization? • How could an attack on one part of an IT network affect other organizational functions? • What is the accumulated risk across a critical infrastructure sector or geography? Using a comprehensive, consistent, and repeatable method to categorize and measure risk can enhance communication and decision-making among executives who make strategic decisions for organizations and their IT staff with day-to-day responsibility for cybersecurity. It can facilitate cooperation between public officials and private industry who share responsibility for different components of national critical infrastructure. It can inform media coverage and public debate about important policy questions, such as which decisions about cybersecurity should be purely private decisions, whether government should incentivize or mandate certain cybersecurity choices, and when a cyber attack warrants some type of military response.
Topic:
Science and Technology, Military Strategy, Cybersecurity, and Media
Political Geography:
Global Focus

2. China on Arms Control, Nonproliferation, and Strategic Stability

Author:
Nancy Gallagher
Publication Date:
08-2019
Content Type:
Working Paper
Institution:
Center for International and Security Studies at Maryland (CISSM)
Abstract:
China and the United States view each other as potential adversaries with mixed motives and divergent value systems, yet both can benefit from cooperation to reduce the risk of war, avert arms races, and prevent proliferation or terrorist access to weapons of mass destruction. The two countries have more common interests, fewer ideological differences, and greater economic interdependence than the United States and the Soviet Union had during the Cold War. In principle, arms control broadly defined, i.e., cooperation to reduce the likelihood of war, the level of destruction should war occur, the cost of military preparations, and the role of threats and use of force in international relations, could be at least as important in this century as it was in the last. In practice, though, China’s rise as a strategic power has not been matched by a corresponding increase in the kinds of cooperative agreements that helped keep the costs and risks of superpower competition from spiraling out of control. Why not? This paper argues that because China’s strategy rests on different assumptions about security and nuclear deterrence than U.S. strategy does, its ideas about arms control are different, too. China has historically put more value on broad declarations of intent, behavioral rules, and self-control, while the United States has prioritized specific quantitative limits on capabilities, detailed verification and compliance mechanisms, and operational transparency. When progress has occurred, it has not been because China finally matched the United States in some military capability, or because Chinese officials and experts “learned” to think about arms control like their American counterparts do. Rather, it has happened when Chinese leaders believed that the United States and other countries with nuclear weapons were moving toward its ideas about security cooperation--hopes that have repeatedly been disappointed. Understanding Chinese attitudes toward security cooperation has gained added importance under the Trump administration for two reasons. Trump’s national security strategy depicts China and Russia as equally capable antagonists facing the United States in a “new era of great power competition,” so the feasibility and desirability of mutually beneficial cooperation with China have become more urgent questions. The costs and risks of coercive competition will keep growing until both sides accept that they outweigh whatever benefits might accrue from trying to maximize power and freedom of action in a tightly interconnected world.
Topic:
Diplomacy, Nuclear Weapons, Military Strategy, and Nonproliferation
Political Geography:
United States, China, Taiwan, and Asia