Cybersecurity
Paragraphs

Organizations routinely face risk trade-offs. Broadly modeling a system can act as decision support in the face of significant uncertainty about an organizations threats, vulnerabilities, and defenses. This paper gives an example of a policy brief discussing the security of different security configurations for laptops at a large organization.

All Publications button
1
Publication Type
Policy Briefs
Publication Date
Authors
Elisabeth Paté-Cornell
Paragraphs

Organizations often record cybersecurity incidents to track employee workload, satisfy auditors, fulfil reporting requirements, or to analyze cyber risk. While security incident databases are often neglected, they contain invaluable information that can be leveraged to assess the threats, vulnerabilities, and impacts of cyber attacks, providing a detailed view of cyber risk in an organization. This paper emphasizes what data is useful for a risk assessments and how data should be recorded.

All Publications button
1
Publication Type
Working Papers
Publication Date
Authors
Elisabeth Paté-Cornell
Paragraphs

Currently, significant uncertainty surrounds cyber security investments. Chief Information Security Officers do not have an effective framework to compare investments into various security safeguards, such as encryption technology, data loss prevention (DLP), or two-factor authentication. Further, there are not clear methods to assess the risk reduction associated with security investments, thus leaving organizations prone to purchasing ineffective products from security vendors. 
  
Most cyber risk management is done qualitatively, which prevents the comparison of cyber risk to other types of organizational risk. Our research uses probabilistic risk analysis (PRA) to quantitatively assess cyber risk in organizations (in dollar terms). We outline a portfolio of tools and techniques to assess different cyber risks. For example, we use probabilistic inputs to determine if full disk encryption is cost effective, given the rate of laptop thefts and data disclosures. Our quantitative framework allows explicit trade-offs between high-frequency, low cost incidents and low-frequency, high cost incidents.

All Publications button
1
Publication Type
Commentary
Publication Date
Authors
Elisabeth Paté-Cornell
Paragraphs

Despite significant interest in cybersecurity, data on cyber security incidents remains scarce. On April 16, 2015, the US Department of Energy released data on 1,131 cybersecurity incidents through a Freedom of Information Act Request. While only containing the date, location, and type of incident, several interesting insights can be kneaded from the data. In this paper, we analyze the DOE security incident data and perform a statistical analysis on the rate of incidents. We find that the rate of cybersecurity incidents is decreasing over time and that incidents can be modeled stochastically. We believe that this is further evidence that cyber risk can be accurately evaluated with data-driven models.

All Publications button
1
Publication Type
Working Papers
Publication Date
Authors
Elisabeth Paté-Cornell
-

On Wednesday, February 24, CDDRL, in partnership with the Center for International Governance Innovation (CIGI), hosted...

Posted by Stanford Center on Democracy, Development, and the Rule of Law (CDDRL) on Friday, February 19, 2016

On Wednesday, February 17, The Center on Democracy, Development and the Rule of Law at Stanford, The Center for International Governance Innovation, and the Research Advisory Network of the Global Commission on Internet Governance will present an all-day conference entitled "New Alliances in Cybersecurity, Human Rights and Internet Governance." The conference will discuss the challenges of creating a regime of internet governance that pays attention to security and human rights in the digital context. 

Carl Bildt, former Prime Minister & Foreign Minister of Sweden, and Chair of the Global Commission on Internet Governance (GCIG) and Marc Andreessen, co-founder of Netscape and Andreessen Horowitz are the scheduled keynote speakers. Other speakers for the event include Michael McFaul (Director FSI), Eileen Donahoe (Human Rights Watch/FSI), Sir David Omand (former Director, GCHQ, UK), Michael Chertoff (former Secretary of Homeland Security, USA) and Marietje Schaake (Member of the European Parliament.)

 

Admission will be closed at 120 guests - only those who have sent an rsvp will be admitted. 

 

[[{"fid":"222058","view_mode":"crop_870xauto","fields":{"format":"crop_870xauto","field_file_image_description[und][0][value]":"Cybersecurity Andreessen Event","field_file_image_alt_text[und][0][value]":"","field_file_image_title_text[und][0][value]":"","field_credit[und][0][value]":"","field_caption[und][0][value]":"","field_related_image_aspect[und][0][value]":"","thumbnails":"crop_870xauto"},"type":"media","attributes":{"width":"870","class":"media-element file-crop-870xauto"}}]]

616 Serra Street, Stanford, CA 94305

Carl Bildt Former Prime Minister and Foreign Minister, Sweden Keynote speaker Global Commission on Internet Governance
Marc Andreessen Founder, Andreessen Horowitz Keynote speaker Founder, Andreessen Horowitz
Conferences
Authors
News Type
News
Date
Paragraphs

The world remains perilously close to a nuclear disaster or catastrophic climate change that could devastate humanity, according to Stanford experts and California Governor Jerry Brown, who were on hand to unveil the latest update to the Bulletin of Atomic Scientists’ “doomsday clock” on Tuesday.

The symbolic clock was created in 1947 when Albert Einstein and Robert Oppenheimer (the father of the U.S. nuclear program) founded the publication.

The closer the minute hand gets to midnight, the closer their Board of Science and Security predicts humankind is to destroying itself.

“I must say with utter dismay that it stays at three minutes to midnight,” said Rachel Bronson, the publication’s executive director and publisher, in a bi-coastal teleconference carried live from The National Press Club in Washington D.C. and the Stanford campus.

Despite some positive development over the past year, such as the Iran nuclear deal and the Paris climate accords, the doomsday clock is now the closest it’s been to midnight since the peak of Cold War hostilities in the mid 1980s.

Stanford experts, including former U.S. Secretary of Defense William J. Perry and former Secretary of State George P. Shultz, said they agreed with the dire assessment.

“The danger of a nuclear catastrophe today, in my judgment, is greater than it was during the Cold War…and yet our policies simply do not reflect those dangers,” said Perry, who is a faculty member at Stanford’s Center for International Security and Cooperation.

Perry said he was especially concerned that the U.S. and Russia were engaged in new arms race, with both countries working to rapidly modernize their nuclear arsenals.

“Whatever we need to do for deterrence, it does not require rebuilding what we did during the Cold War era,” he said.

Perry urged President Barack Obama not to give up on the goal of nuclear disarmament during his last year in office, and to push for a breakthrough deal to control fissile material at the upcoming Nuclear Summit in Washington D.C.

“These summit meetings have been quite significant, and if he can use this last summit meeting to establish international standards for fissile control, which fifty heads of state sign up to, that would be a real achievement,” Perry said.

Shultz said the U.S. needed to offer a new version of the bold plans and decisive actions that legendary American statesmen George Marshall and Dean Acheson pursued after World War II.

“We have to be engaged, because when we don’t give leadership, nobody does,” said Shultz, a distinguished fellow at the Hoover Institution.

The doomsday clock was initially designed to communicate the threat from nuclear weapons, but has since been expanded to include cyber and biosecurity and the dangers of unsustainable climate change.

California Governor Jerry Brown described climate change as a “daunting threat,” with many similarities to nuclear dangers.

“Climate change and nuclear accident or nuclear war or nuclear sabotage or nuclear terrorism, they’re tied together,” Brown said.

“Climate change is moving slowly, but tipping points are around the corner and you don’t know when you’ve reached one, and beyond a tipping point, we may not be able to come back.”

Brown said he was dismayed at the lack of political action to address climate change and nuclear threats.

“I’ve been around politics all my life, and I can see an obviously broken process, a democratic system that has turned more into spectacle than getting the job done,” Brown said.

“In order to have the political leaders deal with this, they have to first acknowledge it.”

When a high school student in the audience asked what he could personally do to tackle the threat of nuclear weapons, Perry said the most important step was to educate himself about the issues, so he could educate others.

“If you can get ten people interested in talking about this problem, and each of those ten can get ten people interested in talking about this problem, it builds up in a geometric progression,” Perry said.

“I think once the public understands the dangers, they will galvanize our Congress and our leaders into action.”

 

Hero Image
Former U.S. Secretary of Defense William J. Perry (center) speaks at a press conference announcing the Bulletin of Atomic Scientists' latest "doomsday clock" estimates, as former U.S. Secretary of State George P. Shultz (left) and California Governor Jerr
Former U.S. Secretary of Defense William J. Perry (center) speaks at a press conference announcing the Bulletin of Atomic Scientists' latest "doomsday clock" estimates, as former U.S. Secretary of State George P. Shultz (left) and California Governor Jerry Brown (right) look on.
Christian Pease
All News button
1
Authors
News Type
News
Date
Paragraphs

 

 

Deborah Lee James U.S. Secretary of the Air Force Deborah Lee James speaks at a roundtable on cyber policy at Stanford University on January 6, 2016.

 

The U.S. military needs to train and recruit more “cyber warriors,” and improve its offensive and defensive capabilities in cyberspace, Secretary of the Air Force Deborah Lee James said during a visit to Stanford University last week.

“Today we’re not sufficiently strategizing, organizing, training or equipping to be cyber warriors,” James said at a roundtable discussion on cyber policy. “We’ve made progress over the last year or two, but it’s not good enough. We need to do more, to be open to different ways of bringing people on and retaining people so we can bring the best and brightest into our ranks.”

She called on Silicon Valley to “move past the debate over Edward Snowden and the debate over encryption” and help the military combat cyber threats to U.S. national security. “Particularly here in Silicon Valley, how can we get better access…and work better with some of the great innovations here in Silicon Valley?” she asked.

Deborah Lee James U.S. Secretary of the Air Force Deborah Lee James (left) meets with former Secretary of Defense William J. Perry (second from right) and former Secretaries of State Condoleezza Rice and George P. Shultz (far right) during a visit to Stanford University on January 6, 2016.

Stanford University was just one of the stops on James’ schedule, which also included meetings at Google, Facebook, FireEye and In-Q-Tel (the investment arm of the U.S. intelligence community).

James said she’d come to Silicon Valley to “listen and learn” and search for “the next big thing” – from drones to big data.

“We’re actively on the hunt for what will be our next advantage as the military,” she said.

She said the military was working to streamline its procurement process so it could move more quickly fund new technological development using what she called “rapid acquisition.”

“You can’t build the next fighter aircraft under this, but you can build smaller types of technological products and get something under contract within 30 days,” she said.

Protecting networked weapons systems and critical infrastructure at military bases were two top priorities for the Air Force, James said.

It is also working to develop better defensive capabilities to protect satellites and other assets in space, and prevent adversaries from disabling critical missile warning and global positions systems, James said.

“Space had been a fairly tranquil, uncontested area,” she said.

“Nowadays, space is much more contested and congested. There are many more companies and countries up there.

“If a conflict on earth bleeds into space in some way, how do we defend our constellation?”

Military operations centers will need to integrate more cyber capabilities in order to create more options for defense and offense, James said.

“What we need in future is a multi-domain operations center where we’re fully plugged in terms of cyber and space...so that a commander at every turn has military options that go beyond bombing a target,” she said.

“The President, the Secretary of Defense, everybody is pressing, ‘We want more options. We want more targets.’.”

But James acknowledged that even digital conflict could cause collateral damage in the physical world.

“Let’s say we take out a power grid to shut down a particular part of a country to stop a military action,” she said.  “Maybe you’d shut off power to a hospital and people would die.”

That’s why cyber operations would continue to be governed by the law of armed conflict.

“Before a cyber target would be hit, there would be a legal decision with other parts of the government,” James said. “It’s not solely [up to] a commander on the scene.”

In an indication of the growing importance of cyber operations, political and military leadership in Washington are considering elevating U.S. Cyber Command from under U.S. Strategic Command to become its own unified command, James said.

The Air Force currently has around 1,700 personnel working directly on cyber offense and defense, spread among the National Guard, Reserves and active duty. And it recently established a new Cyber College at Air University on Maxwell Air Force base in Montgomery, Alabama to train more internal talent.

But military leaders are also looking for other ways to scale up their cyber forces, James said.

“Maybe leveraging the private sector and leveraging Silicon Valley can help us,” she said.

Hero Image
Deborah Lee James
U.S. Secretary of the Air Force Deborah Lee James speaks at a roundtable on cyber policy at Stanford University on January 6, 2016.
Rod Searcey
All News button
1
-

Abstract: Faster evolving technologies, new peer adversaries, and the increased role of non-government entities changes how we think about decisions to develop and adopt new technology. Uncertainties about technology “shelf life,” adversary intentions, and dual uses of technology complicate these decisions. This seminar will discuss the use of mathematical models and optimization methods to provide insight on technology policy issues. These issues include: balancing risk and affordability during technology research and development; timing technology adoption; and understanding adversary responses to new technologies. Examples will be discussed from offensive cyber operations and synthetic biology. We will conclude by discussing implications for how policy analysts and policy makers think about technology and security.

 

About the Speaker: Philip Keller is a National Defense Science and Engineering Graduate Fellow at Stanford. He is completing his PhD in Management Science & Engineering. He studies technology policy problems posed by new technologies. His research is highly interdisciplinary, drawing on methods from engineering risk and decision analysis, game theory, and operations research. His professional experience includes conducting studies and analysis for the Department of Defense and the Department of Homeland Security at RAND and the Homeland Security Studies and Analysis Institute. Previous study topics include unmanned aircraft operations; nuclear terrorism; offensive cyber operations; and military force structure. Philip holds a BS in Mathematics and an MS in Defense and Strategic Studies.

Predoctoral Fellow CISAC
Seminars
Paragraphs

Technical and operational realities make it prohibitively difficult to adapt a Cold War paradigm of “deterrence stability” to the new domain of cyber warfare. Information quality problems are likely to forestall the development of a cyber equivalent of the strategic exchange models that assessed deterrence stability during the Cold War. Since cyberspace is not firmly connected to geographic space the way other domains are, it makes modeling extremely difficult as well as muddles neat conceptual distinctions between “counterforce” (military) and “countervalue” (civilian) targets. These obstacles seriously complicate U.S. planning for a credible cyber “assured response,” and also present substantial challenges to potential adversaries contemplating cyber attacks against U.S. interests. To create a maximally effective deterrent against cyber threats, the United States should seek to maximize the challenges for possible opponents by creating a cyber “strategy of technology” emphasizing resilience, denial, and offensive capabilities.

All Publications button
1
Publication Type
Journal Articles
Publication Date
Journal Publisher
Strategic Studies Quarterly
Authors
Number
4
-

Abstract: Cybersecurity depends heavily on civilian cyber defense, which is decentralized, private, and voluntary. Although the structure of this field stands to have a profound impact on national and international security, its history is rarely subject to critical or comparative analysis. Why is civilian cyber defense organized this way? There are at least three plausible explanations for the origins and evolution of cyber defense as an organizational field: technology, bureaucracy, and ideology. I examine the influence of each factor during the formative years of the Internet in the United States. From the beginning, malware was described in terms of infectious disease (viruses and worms), so I use public health to provide comparative context for cyber defense. I find that technological determinism explains far less about the genesis of this field than often assumed. Bureaucratic politics are also insufficient. Therefore, I argue that the American ideology of anti-statism is necessary to explain civilian cyber defense, and this family of ideas has important implications for security cooperation at home and abroad.

About the Speaker: Frank Smith is a Senior Lecturer with the Centre for International Security Studies and the Department of Government and International Relations at the University of Sydney. His teaching and research examine the relationship between technology and international security. His book, American Biodefense, explains why the U.S. military struggled to defend itself and the country against biological warfare and bioterrorism. His current research examines cyber security cooperation; he is also analyzing the potential impact of quantum computing on international relations. Previously, Smith was a visiting scholar with the Institute for Security and Conflict Studies at the Elliott School of International Affairs, a research fellow with the Griffith Asia Institute, and a pre-doctoral fellow with the Center for International Security and Cooperation at Stanford University. He has a Ph.D. in political science and a B.S. in biological chemistry, both from the University of Chicago. 

Frank Smith Senior Lecturer Speaker Centre for International Security Studies; Department of Government and International Relations, University of Sydney
Seminars
Subscribe to Cybersecurity