Search

Begin New Search Topic Cybersecurity Publication Year within 25 Years

81. Reforming the U.S. Approach to Data Protection and Privacy

Author:
Nuala O'Conner
Publication Date:
01-2018
Content Type:
Working Paper
Institution:
Council on Foreign Relations
Abstract:
Half of all Americans believe their personal information is less secure now than it was five years ago, and a sobering study from the Pew Research Center reveals how little faith the public has in organizations, whether governmental or private-sector, to protect their data—and with good reason. In 2017, there was a disastrous breach at Equifax, Yahoo’s admission that billions of its email accounts were compromised, Deep Root Analytics’ accidental leak of personal details of nearly two hundred million U.S. voters, and Uber’s attempt to conceal a breach that affected fifty-seven million accounts. Individuals are left stymied about what action they can take, if any, to protect their digital assets and identity. Nuala O’Connor Yet record-shattering data breaches and inadequate data-protection practices have produced only piecemeal legislative responses at the federal level, competing state laws, and a myriad of enforcement regimes. Most Western countries have already adopted comprehensive legal protections for personal data, but the United States—home to some of the most advanced, and largest, technology and data companies in the world—continues to lumber forward with a patchwork of sector-specific laws and regulations that fail to adequately protect data. U.S. citizens and companies suffer from this uneven approach—citizens because their data is not adequately protected, and companies because they are saddled with contradictory and sometimes competing requirements. It is past time for Congress to create a single legislative data-protection mandate to protect individuals’ privacy and reconcile the differences between state and federal requirements.
Topic:
Science and Technology, Cybersecurity, Privacy, Data, and Digitization
Political Geography:
United States and North America

82. Increasing International Cooperation in Cybersecurity and Adapting Cyber Norms

Author:
Elena Chernenko, Oleg Demidov, and Fyodor Lukyanov
Publication Date:
02-2018
Content Type:
Working Paper
Institution:
Council on Foreign Relations
Abstract:
nformation and communications technology (ICT) presents one of the most critical modern challenges to global security. Threat assessments predict that the next major international crisis could be due to a state or terrorist group weaponizing ICTs to devastate critical infrastructure or military logistics networks. The proliferation of asymmetric warfare (i.e., conflicts between nations or groups that have disparate military capabilities) has increased states’ use of ICTs, which necessitates the development of an international code of cyber conduct. There is an urgent need for cooperation among states to mitigate threats such as cybercrime, cyberattacks on critical infrastructure, electronic espionage, bulk data interception, and offensive operations intended to project power by the application of force in and through cyberspace. Emerging cyber threats could precipitate massive economic and societal damage, and international efforts need to be recalibrated to account for this new reality. A common misperception is that the principal cybersecurity threats demanding urgent international collaboration are massive, state sponsored attacks that target critical infrastructure such as power plants or electrical grids, causing massive devastation and human casualties. In fact, cyber threats are more diverse and complex, often targeting private enterprises and endangering the technical integrity of the digital world. The near-total digitalization of business models makes the global economy more vulnerable to cyberattacks, not only from states but also from criminal organizations and other nonstate actors.
Topic:
Security, International Cooperation, Infrastructure, and Cybersecurity
Political Geography:
Global Focus

83. Cybersecurity and the New Era of Space Activities

Author:
David P. Fidler
Publication Date:
04-2018
Content Type:
Working Paper
Institution:
Council on Foreign Relations
Abstract:
The tasks of securing outer space and cyberspace are converging. The internet increasingly depends on space-enabled communication and information services. Likewise, the operation of satellites and other space assets relies on internet-based networks, which makes these assets, like cars and medical equipment, devices on the internet of things. New government actors, companies, goals, and technologies are expanding and transforming space activities. However, neither space policy nor cybersecurity policy is prepared for the challenges created by the meshing of space and cyberspace, which could increase national security risks. To meet these challenges, government, industry, and international action is needed. The Donald J. Trump administration’s National Space Council should develop cybersecurity recommendations for space activities, and federal agencies should prioritize these within the government and in cooperation with the private sector. In crafting needed legislation for commercial space activities, Congress should bolster industry efforts to strengthen cybersecurity. Private-sector actors should strengthen their adoption of cybersecurity best practices and collaborate with one another on improving implementation of cybersecurity strategies. Internationally, the United States should pursue collaboration on space cybersecurity through the North Atlantic Treaty Organization (NATO), plurilateral space cooperation mechanisms, and bilateral forums.
Topic:
Security, Science and Technology, Cybersecurity, and Space
Political Geography:
United States and North America

84. Sharing Classified Cyber Threat Information With the Private Sector

Author:
Robert K. Knake
Publication Date:
05-2018
Content Type:
Working Paper
Institution:
Council on Foreign Relations
Abstract:
The U.S. government and private industry have been stuck at an impasse concerning cybersecurity information sharing for over a decade. While the Barack Obama administration rolled out executive and legislative efforts to increase information sharing, many U.S. companies still argue that the federal government should do more to provide them with useful intelligence on cyber threats. But the U.S. intelligence community argues that greater declassification and sharing of information with private companies could put technical sources and methods at risk. Fixes to this problem exist. The Department of Defense already provides a classified network for cleared defense contractors to receive intelligence on threats to their companies. Replicating this network for cyber threats has long been discussed as a way to share more information with the financial sector, electricity suppliers, and other private-sector entities critical to the U.S. economy. Expanding this network requires increasing the number of cleared personnel and of facilities that can hold classified information, as well as changing intelligence collection priorities. These hurdles can be addressed by cooperative efforts between the public and private sectors. As a crucial first step, the U.S. government should begin the targeted collection of intelligence on cyber threats to critical infrastructure. To disseminate this information, the government should establish security standards different from those applicable to defense contractors to determine who may hold clearances.
Topic:
Security, Cybersecurity, Information Age, and Private Sector
Political Geography:
United States and North America

85. Principles for Growing and Sustaining the Nation’s Cybersecurity Workforce

Author:
Aspen Cybersecurity Group
Publication Date:
11-2018
Content Type:
Working Paper
Institution:
Aspen Institute
Abstract:
The U.S. currently has a cyber workforce shortage of 300,000 individuals and the trend line predicts an increasing gap. This is largely because demand is significantly outpacing supply, large candidate pools are left untapped, employer requirements aren’t well sync’d to the skills needed, and awareness of cyber career paths remains low. After months studying the challenge, the Aspen Cybersecurity Group offers a mix of principles, partnerships, and specific steps employers can take to close the skills gap.
Topic:
National Security, Cybersecurity, Work Culture, and Skilled Labor
Political Geography:
United States of America and North America

86. Cybertools of Political Competition and the 2016 American Presidential Campaign

Author:
Marek Gorka
Publication Date:
01-2018
Content Type:
Journal Article
Journal:
Polish Political Science Yearbook
Institution:
Polish Political Science Association (PPSA)
Abstract:
In the last decade, one can notice the huge interest of researchers in the field of cyberpolicy, which is primarily due to the widespread use of the Internet in the public space. This fact is also an impulse for conducting interdisciplinary research that combines knowl- edge from social sciences on the one hand, and uses content from technical sciences on the other. Compared to the form of conducting election campaigns in the 20th century in the U.S., during the 2016 election campaign there were significant changes in the conduct of po- litical struggle. These changes consist above all in the use of cybernetic tools, which to a large extent, however difficult to determine, shaped electoral behavior. The contemporary political competition is more and more dependent on technology, which becomes the main element of the professionalization of election campaigns. Investigating the impact of cyberspace on electoral results is a big challenge, considering the fact that the area of cybertechnology is extremely complex. Cyberspace has now become a field for many political phenomena that are constantly evolving and in most cases their importance is immense for the functioning of the political system. The article is intended to deal with selected phenomena related to cybertechnology that were compared with other events from the U.S. election campaign in 2016. The article aims to investigate selected events resulting from the use of cybertechnol- ogy, which had an impact on electoral behavior.
Topic:
Elections, Cybersecurity, Social Media, Disinformation, Election Interference, and Digitalization
Political Geography:
North America and United States of America

87. The Shadow Sector: North Korea’s Information Technology Networks

Author:
Andrea Berger, Cameron Trainer, Shea Cotton, and Catherine Dill
Publication Date:
05-2018
Content Type:
Working Paper
Institution:
James Martin Center for Nonproliferation Studies
Abstract:
North Korea’s commercial information technology (IT) industry has operated overseas, largely unnoticed, for decades. It sells a range of products and services including website and app development, administrative and business management software, IT security software, and biometric identification software for law enforcement applications. Its global network includes a myriad of front companies, intermediaries, and foreign partnerships. Yet despite the attention currently paid to North Korea’s overseas revenue streams and its offensive activities in cyberspace, the spotlight has yet to illuminate the money-spinning North Korean IT firms whose offerings seem to have found their way into corporate supply chains and potentially even Western-allied law enforcement agencies. Drawing upon extensive open-source investigations by the authors, this paper examines several nodes in North Korea-linked IT networks and considers the implications for current and future policy efforts to stem North Korean revenue and mitigate the cyber-security threats the country poses.
Topic:
Cybersecurity, Information Age, Disinformation, and Information Technology
Political Geography:
Asia and North Korea

88. The Global Exchange (Summer 2017)

Author:
David J. Bercuson, Hugh Stephens, Robert Hage, Robert Huebert, Stefanie Von Hlatky, Lindsay Rodman, Stephen M. Saideman, Hugh Segal, and Vanja Petricevic
Publication Date:
06-2017
Content Type:
Journal Article
Journal:
The Global Exchange
Institution:
Canadian Global Affairs Institute (CGAI)
Abstract:
The Global Exchange is the Canadian Global Affairs Institute’s quarterly magazine featuring topical articles written by our fellows and other contributing experts. Each issue contains approximately a dozen articles exploring political and strategic challenges in international affairs and Canadian foreign and defence policy. This Summer 2017 issue covers trade deals, human rights, defense, cybersecurity and more.
Topic:
Defense Policy, NATO, Human Rights, Territorial Disputes, Cybersecurity, Trans-Pacific Partnership, Free Trade, Transparency, and Deterrence
Political Geography:
China, Europe, Canada, North America, and Arctic

89. Categorizing and Assessing the Severity of Disruptive Cyber Events

Author:
Nancy Gallagher and Charles Harry
Publication Date:
04-2017
Content Type:
Working Paper
Institution:
Center for International and Security Studies at Maryland (CISSM)
Abstract:
Faced with a rapidly growing volume and range of cyber attacks, policymakers and organizational leaders have had difficulty setting priorities, allocating resources, and responding effectively without a standard way to categorize cyber events and estimate their consequences. Presidential Policy Directive 41 laid out the Obama administration’s principles for executive branch responses to significant cyber incidents in the public or private sector. But it neither drew important distinctions between different types of cyber incidents, nor gave a standard way to determine where a particular incident falls on its 0-5 point severity scale. This policy brief demonstrates how an analytical framework developed at the Center for International and Security Studies at the University of Maryland (CISSM) can help address these problems. It first differentiates between low-level incidents and more significant cyber events that result in either exploitation of information and/or disruption of operations. It categorizes five types of disruptive events and analyzes 2,030 cyber events in a dataset developed from media sources, showing that cyber exploitation remains more common than disruption, and that most disruptive activity fits into two categories: message manipulation and external denial of service attacks. Finally, the brief offers a standard method to assess the severity of different categories of disruptive attacks against different kinds of organizations based on the scope, magnitude, and duration of the event. This Cyber Disruption Index (CDI) is then applied to survey data on Distributed Denial of Service (DDoS) attacks in the private sector to assess severity within a common category of disruptive events. Of 3,900 cases reported, only 5 events (less than 1% of the DDoS cases) had a combined scope, magnitude, and duration severe enough to be a priority for prevention and potentially warrant government involvement.
Topic:
Government, Cybersecurity, and Media
Political Geography:
United States, Washington, and D.C.

90. International Cybersecurity Information Sharing Agreements

Author:
Nilsu Gören and Theresa Hitchens
Publication Date:
10-2017
Content Type:
Working Paper
Institution:
Center for International and Security Studies at Maryland (CISSM)
Abstract:
Cybersecurity transcends national boundaries in many ways: The internet’s technical infrastructure is global in scope; threat actors based in one country can disguise their identities by taking control of computers in other countries; global businesses sell software, hardware, and security services that may introduce or combat vulnerabilities; and the consequences from a disruptive attack can spread far beyond the initial victim. Even the most cyber-savvy country cannot protect itself completely unless it wants to disconnect from the global internet and strictly limit who can use information technology and for what purposes inside its own borders. And this course of action is infeasible because it would result in dire consequences for the national economy, military, and all other systems that depend on advanced information technology. International cooperation to improve cybersecurity is a much more realistic and viable path. Information sharing is the most commonly promoted type of international cooperation, but very little is known about what type of cybersecurity information is currently being shared with whom, for what purposes, and under what conditions. As a first step towards answering this larger question, the International Cybersecurity Information Sharing Project undertook to survey, catalog, and analyze publicly available government-to-government cybersecurity-related sharing agreements to determine what types of information various governments have committed to share, and to identify gaps in information sharing. The ultimate aim of the larger project is to assess how multilateral cybersecurity sharing practices can be encouraged and improved in order to strengthen global cybersecurity. The project team started from the assumption that formal cyber sharing agreements and memoranda of understanding (MoU) are an important part of the foundation for the development of norms on cyber cooperation. Over the past several years, various international fora have reiterated that sharing information about cyber threats and vulnerabilities, national approaches to cyber protection, best practices, incidents of concern, and response mechanisms could increase mutual cybersecurity while reducing risks of misunderstandings and conflict. Different types of information sharing can be used to improve cybersecurity in various ways. By sharing threat perceptions and national policies, states can better understand each other’s concerns and priorities. By conducting multilateral exercises and sharing best practices for protection of networks, critical infrastructure, and software/hardware, states can help each other ensure safe data transfer across borders. Cooperation to build capacity in states with weaker infrastructure for managing the use of information and communications technologies (ICTs) can help in identifying threats and responding to crises. This research found that cybersecurity information agreements are more numerous, but less specific than anticipated. The project documented and analyzed 196 agreements involving 116 different countries and 2,349 signatures. Extensive signature of agreements and associated commentary shows widespread accord on the principle that information sharing is necessary. However, it is unclear how much and what type of information sharing occurs in practice. Few agreement texts are public, and those that are often use vague language. And, despite the potential benefits of sharing more cyber-security information, many disincentives and logistical barriers remain. This project collected as much information as possible, not only about what states have agreed to do, but also what they actually do, and why they make those choices. After a brief summary of the approach taken and some limitations encountered, the study provides summary statistics about international cyber information sharing agreements. It then looks in more detail at sharing agreements and behaviors by some of the most active and/or important countries in regional organizations, and in multilateral fora that have focused on this topic. A summary of key findings, conclusions, and next steps is followed by annexes with more methodological information and texts for some of the most important agreements.
Topic:
Science and Technology and Cybersecurity
Political Geography:
Global Focus