The science of cyber risk looks at a broad spectrum of risks across a variety of digital platforms. Often though, the work done within the field is limited by a failure to explore the knowledge of other fields, such as behavioral science, economics, law, management science, and political science. In a new Science Magazine article, “Cyber Risk Research Impeded by Disciplinary Barriers,” cyber risk experts and researchers at Stanford University make a compelling case for the importance of a cross-disciplinary approach. Gregory Falco, security researcher at the Program on Geopolitics, Technology, and Governance, and lead author of the paper, talked recently with the Cyber Policy Center about the need for a holistic approach, both within the study of cyber risk, and at a company level when an attack occurs.

CPC: Your recent perspective paper in Science Magazine highlights the issue of terminology when it comes to how organizations and institutions define a cyber attack. Why is it so important to have consistent naming when we are talking about cyber risk?

Falco: With any scientific discipline or field, there is a language for engaging with other experts. If there’s no consistent language or at least dialect for communication around cyber risk, it’s difficult to engage with scholars from different disciplines. For example: The phrase “cyber event” is contested and the threshold for what an organization considers to be a cyber event varies substantially. Some organizations consider someone pinging their network as a cyber event, others only consider something a cyber event once an intrusion has been publicly disclosed. So there’s a disparity when comparing metrics of cyber events from organization to organization because of the different thresholds of what’s considered an event.

CPC: We’ve all been sent one of those emails letting us know our data may have been compromised and your paper points out it’s nearly impossible to put foolproof protections into place; attacks are inevitable. Given that, how should companies weigh the various ways they can protect themselves?

Falco: The first exercise each organization should go through when they decide to be serious about cyber risk is to prioritize their assets. What is business critical? What is safety critical? Then, like all other risks, a cost-benefit analysis must be done for each asset based on its priority. If the asset is safety-critical, then resources should be allocated to help protect that asset or at least ensure its resilience. Trade-offs are inevitable, no company has unlimited resources. But starting with an understanding of where the priorities are, is critical.

CPC: In companies, cyber security often falls entirely to the Chief Information Security Officer (CISO). Your paper argues that’s shortsighted. What is gained when a company takes a more holistic approach?

Falco: Distributing responsibility across the organization catalyzes a security culture. A security culture is one where there is a constant vigilance or at least broad awareness of cybersecurity concerns throughout the organization. Fostering a security culture is often suggested as a mechanism to help reduce cyber risk in organizations. The problem with not distributing responsibility is that when something happens, it’s too easy to resort to finger-pointing at the CISO, and that’s counterproductive. Efforts after an attack should be on responding and being resilient, not finding the scapegoat.

CPC: Cyber risk largely focuses on prevention, but your paper argues that it’s what happens after an attack in that needs greater attention. Why is that?

Falco: Every organization will be attacked. However organizations can differentiate themselves from a cyber risk standpoint by appropriately managing the situation after an attack. Some of the most significant damages to organizations can be reputational if communication after an attack is unclear or botched. Poor communication after an attack can result in major regulatory fines or valuation adjustments as seen in cases like Yahoo and that can have major business implications. Communications aren’t the only important element of post-attack response. A thorough post-mortem of the organization’s response to the attack can be an important learning experience and a way to plan for future attacks.

CPC: Protecting against cyber attacks and the losses that go with them can obviously be costly for companies. You make a case for collaboration among different fields, say among data scientists and economists. How can that be encouraged?

Falco: We argue that cross-disciplinary collaboration rarely happens organically. Therefore, we call on funding agencies like the NSF or DARPA to specify a preference for cross disciplinary research when funding cyber risk projects. Typically, this isn’t currently a feature of calls for proposals, but for cyber risk programs it should be. We encourage researchers to explore cyber risk questions at the margins of their discipline. Those questions may lend themselves to potential overlap with other disciplines and foster a starting point for cross-disciplinary collaboration.

For more on these topics, see a full list of recent publications from the Cyber Policy Center and the Program on Geopolitics, Technology, and Governance.

"Ideologically, today’s autocrats are a more motley and pragmatic crew. They generally claim to be market friendly, but mainly they are crony capitalists, who, like Putin in Russia, Orban in Hungary, and Erdogan in Turkey, are first concerned with enriching themselves, their families, and their parties and support networks. Increasingly, they raise a common flag of cultural conservatism, denouncing the moral license and weakness of the “the liberal West” while advancing a virulent antiliberal agenda based on nationalism and religion," writes Larry Diamond. Read here. 

Immigrants, once settled in a particular state, will not move to another state in search of public health benefits, Stanford researchers find.

Whether it’s designing equipment or developing drugs, scientists often fail to consider how gendered preferences, biases and assumptions can lead to unintended consequences.

According to Stanford historian Londa Schiebinger, it’s time for science to catch up.

The Financial Times named Norman Naimark's latest book, Stalin and the Fate of Europe: The Postwar Struggle for Sovereignty, one of the best history books in 2019. The Financial Times writes "Naimark has few peers as a scholar of Stalinism, the Soviet Union and mid-20th-century Europe. Here he selects seven case studies, from Denmark and Finland to Austria and Albania, to illustrate the complexity of Stalin’s objectives after the second world war as European leaders on both sides of the emerging Iron Curtain strove to reclaim national sovereignty."

Read the rest at Financial Times

The Democrats are facing a dilemma: If they defend democratic norms by acting to remove President Trump from office, they risk getting dragged into a polarizing style of politics that works to his political advantage. Read here.

Since November 2018, a grassroots revolt of the forgotten lower middle classes from France’s far-flung suburbs and rural areas has risen against high taxes; social injustice; and the elites, President Emmanuel Macron foremost among them. Although this “Yellow Vest” movement is not dead, it is now weakened by internal feuds, excessive violence, a takeover by the far left, and Macron’s deft handling. Yet this revolt of “la France profonde” has underscored the fragility of Macron’s narrow sociological and political base. Macron’s decisive 2017 election victory owed more to his outsider status, the collapse of the traditional political establishment, and the rejection of the far right (led by Marine Le Pen) than to his free-market and pro-European agenda. In part, the Yellow Vest version of populism was a response to the “populism of the elites” embodied by Macron in 2017. The Yellow Vest movement further illustrates the central class and polarized ideological cleavages that shape the politics of a growing number of advanced democracies. Read here.

Our Francis Fukuyama and UELP alumni, Sergii Leshchenko (Draper Hills Summer Fellow 2017) and Oleksandra Ustinova (Ukrainian emerging leaders 2018-9), are feat inMichelle Goldberg's NYT opinion piece "The Beacon Has Gone Out: What Trump & Giuliani Have Wrought." Read here.