The science of cyber risk looks at a broad spectrum of risks across a variety of digital platforms. Often though, the work done within the field is limited by a failure to explore the knowledge of other fields, such as behavioral science, economics, law, management science, and political science. In a new Science Magazine article, “Cyber Risk Research Impeded by Disciplinary Barriers,” cyber risk experts and researchers at Stanford University make a compelling case for the importance of a cross-disciplinary approach. Gregory Falco, security researcher at the Program on Geopolitics, Technology, and Governance, and lead author of the paper, talked recently with the Cyber Policy Center about the need for a holistic approach, both within the study of cyber risk, and at a company level when an attack occurs.

CPC: Your recent perspective paper in Science Magazine highlights the issue of terminology when it comes to how organizations and institutions define a cyber attack. Why is it so important to have consistent naming when we are talking about cyber risk?

Falco: With any scientific discipline or field, there is a language for engaging with other experts. If there’s no consistent language or at least dialect for communication around cyber risk, it’s difficult to engage with scholars from different disciplines. For example: The phrase “cyber event” is contested and the threshold for what an organization considers to be a cyber event varies substantially. Some organizations consider someone pinging their network as a cyber event, others only consider something a cyber event once an intrusion has been publicly disclosed. So there’s a disparity when comparing metrics of cyber events from organization to organization because of the different thresholds of what’s considered an event.

CPC: We’ve all been sent one of those emails letting us know our data may have been compromised and your paper points out it’s nearly impossible to put foolproof protections into place; attacks are inevitable. Given that, how should companies weigh the various ways they can protect themselves?

Falco: The first exercise each organization should go through when they decide to be serious about cyber risk is to prioritize their assets. What is business critical? What is safety critical? Then, like all other risks, a cost-benefit analysis must be done for each asset based on its priority. If the asset is safety-critical, then resources should be allocated to help protect that asset or at least ensure its resilience. Trade-offs are inevitable, no company has unlimited resources. But starting with an understanding of where the priorities are, is critical.

CPC: In companies, cyber security often falls entirely to the Chief Information Security Officer (CISO). Your paper argues that’s shortsighted. What is gained when a company takes a more holistic approach?

Falco: Distributing responsibility across the organization catalyzes a security culture. A security culture is one where there is a constant vigilance or at least broad awareness of cybersecurity concerns throughout the organization. Fostering a security culture is often suggested as a mechanism to help reduce cyber risk in organizations. The problem with not distributing responsibility is that when something happens, it’s too easy to resort to finger-pointing at the CISO, and that’s counterproductive. Efforts after an attack should be on responding and being resilient, not finding the scapegoat.

CPC: Cyber risk largely focuses on prevention, but your paper argues that it’s what happens after an attack in that needs greater attention. Why is that?

Falco: Every organization will be attacked. However organizations can differentiate themselves from a cyber risk standpoint by appropriately managing the situation after an attack. Some of the most significant damages to organizations can be reputational if communication after an attack is unclear or botched. Poor communication after an attack can result in major regulatory fines or valuation adjustments as seen in cases like Yahoo and that can have major business implications. Communications aren’t the only important element of post-attack response. A thorough post-mortem of the organization’s response to the attack can be an important learning experience and a way to plan for future attacks.

CPC: Protecting against cyber attacks and the losses that go with them can obviously be costly for companies. You make a case for collaboration among different fields, say among data scientists and economists. How can that be encouraged?

Falco: We argue that cross-disciplinary collaboration rarely happens organically. Therefore, we call on funding agencies like the NSF or DARPA to specify a preference for cross disciplinary research when funding cyber risk projects. Typically, this isn’t currently a feature of calls for proposals, but for cyber risk programs it should be. We encourage researchers to explore cyber risk questions at the margins of their discipline. Those questions may lend themselves to potential overlap with other disciplines and foster a starting point for cross-disciplinary collaboration.

For more on these topics, see a full list of recent publications from the Cyber Policy Center and the Program on Geopolitics, Technology, and Governance.

"Ideologically, today’s autocrats are a more motley and pragmatic crew. They generally claim to be market friendly, but mainly they are crony capitalists, who, like Putin in Russia, Orban in Hungary, and Erdogan in Turkey, are first concerned with enriching themselves, their families, and their parties and support networks. Increasingly, they raise a common flag of cultural conservatism, denouncing the moral license and weakness of the “the liberal West” while advancing a virulent antiliberal agenda based on nationalism and religion," writes Larry Diamond. Read here. 

Of all of the countries in the world attempting a transition to democracy, Francis Fukuyama thinks that Ukraine is the most promising.

“The election of [Volodymyr] Zelensky and the new parliament is just a miracle,” Fukuyama told Freeman Spogli Institute for International Studies (FSI) Director Michael McFaul on the World Class podcast. “Can you imagine, a country getting rid of two-thirds of its parliament and starting over with new people, many of whom are under 35 years old?” 



Ukraine is at a crossroads of sorts, said Fukuyama, who is the Olivier Nomellini Senior Fellow at FSI, and the director of both the Center on Democracy, Development and the Rule of Law and the Ford Dorsey Master’s in International Policy program. On one hand, the country could use this opportunity to transition into a successful reformist government, or its efforts could fail and the government could collapse. 

It doesn’t help that Ukraine’s relationships with foreign allies are not as strong as they once were, he told McFaul.

[Get stories like this delivered to your inbox by signing up for FSI email alerts]

“The United States had been their strongest ally, but now there’s a president in the White House who doesn’t particularly like them,” he explained. “I think Germany and France are also both weakening in their support for Ukraine’s independence, so [Ukraine is] in a really tough spot.”

Before Ukraine’s Orange Revolution in 2004, Fukuyama said he actually thought the country would be among the least likely to liberalize in the way that it has. One important factor in Ukraine’s success has been the exercise of broad individual and political freedoms —  for example, Ukraine’s press has stayed active throughout the years and the country boasts many investigative journalists, he said.

“In a way, it’s a very free and open society with lots of creativity,” Fukuyama noted. “You can criticize the government. I actually think [Vladimir] Putin’s invasion of Ukraine has stimulated Ukrainian nationalism — I think it made citizens realize that they actually do have something to lose.”

[Ready to dive deeper? Read “Small Battle in a Big War: The Post-Maidan Transformation of the National Bank of Ukraine”]

Fukuyama has been interested in Ukraine for a while now — he’s visited the country six times over the past five years. During his most recent trip in November 2019, he taught a crash-course in policymaking to 50 of Ukraine’s members of parliament. With an average age of 41, it’s the country’s youngest parliament ever elected, and many of the newest members have no previous political experience.

He described his time with the young Ukraianian members as inspiring, adding that they want to see a genuine democracy, and to eliminate corruption in their country.

“It does seem to me that we who live in democracies owe it to the people of Ukraine to support them,” Fukuyama said. “Because if they fail, it’s going to have repercussions way beyond Ukraine.” 

Related: Listen to Fukuyama explain “identity politics,” where it comes from and how it will shape the future of our society, on a previous episode of World Class.

The Democrats are facing a dilemma: If they defend democratic norms by acting to remove President Trump from office, they risk getting dragged into a polarizing style of politics that works to his political advantage. Read here.

Our Francis Fukuyama and UELP alumni, Sergii Leshchenko (Draper Hills Summer Fellow 2017) and Oleksandra Ustinova (Ukrainian emerging leaders 2018-9), are feat inMichelle Goldberg's NYT opinion piece "The Beacon Has Gone Out: What Trump & Giuliani Have Wrought." Read here.