Rewired: The Past, Present, and Future of Cybersecurity

Title Page......Page 5
Copyright Page
......Page 6
Contents......Page 7
Notes on Contributors: Introduction......Page 13
Acknowledgments......Page 17
Introduction......Page 19
1.1 Introduction......Page 27
1.2.1 Government-centric Sharing Models
......Page 30
1.2.2 Government-Prompted, Industry-Centric Sharing Models
......Page 34
1.2.4 Small, Highly Vetted, Individual-based Groups
......Page 36
1.2.5 Open Communities and Platforms......Page 37
1.2.6 Proprietary Products and Commercialized Services......Page 38
1.3.1 Trust and the Trade‐offs......Page 39
1.3.2 The Ecosystem and the Role of the Federal Government......Page 40
Notes......Page 41
2.1 Introduction......Page 45
2.2 Why the GCC?......Page 46
2.3 Key Cybersecurity Incidents......Page 47
2.4 Government Organizations......Page 48
2.5 Strategies, Laws, and Standards......Page 50
2.6 The Cybersecurity Industry......Page 52
2.7 Conclusion......Page 54
Notes......Page 55
3.1 Introduction......Page 63
3.2 The IoT’s Risks and Uncertainties......Page 65
3.3 Adaptive Policymaking in the Context of IoT......Page 67
3.4 The UK Policy Landscape......Page 68
3.5 The IoT and its Governance Challenges......Page 72
3.6 Conclusion......Page 74
Notes......Page 75
4.1 Introduction: The Challenge of Ecosystem Risk......Page 83
4.1.1 Aviation Is a National and Global Target......Page 84
4.1.1.1 The Cyber Harm......Page 85
4.1.1.4 Reputational Harm......Page 86
4.1.2 Domestic and International Challenges of Aviation Governance......Page 87
4.2 Progress So Far......Page 89
4.2.1 The AIAA’s Decision Paper, “The Connectivity Challenge: Protecting Critical Assets in a Networked World” (August 2013)......Page 90
4.2.3 The Civil Aviation Cybersecurity Action Plan (December 2014)......Page 92
4.2.5 Hackers Allege Aircraft Vulnerabilities (2015)......Page 93
4.2.7 Aviation Security World Conference (2015)......Page 94
4.2.8 Conferences and Organizations Mature (2015 and Beyond)......Page 95
4.3 Aviation’s Tools for Cyber Risk Governance......Page 96
4.4.1 Collective Third-Party Risk Management
......Page 97
4.4.2 Secure Design......Page 98
4.4.3 Information Sharing, “Plus”......Page 99
4.4.4 International Norms and Standards......Page 100
Notes......Page 101
5.1 Introduction......Page 107
5.2 Conceptualizing Cybersecurity Governance......Page 108
5.3.1.1 Background......Page 110
5.3.1.2 Events......Page 111
5.3.2.2 Events......Page 112
5.3.2.3 Learnings......Page 114
5.3.3.3 Learnings......Page 115
5.4 Utility and Limitations......Page 116
Notes......Page 118
6.1 Introduction......Page 123
6.2 Governance, Security, and Critical Infrastructure Protection......Page 124
6.3 Financial Services Information Sharing and Analysis Center......Page 126
6.4 Financial Services Sector Coordinating Council......Page 130
6.5 Financial Systemic Analysis and Resilience Center......Page 134
6.6.1 Lesson One: Affirmation of PPP Model, but Focus and Clarity Needed......Page 135
6.6.2 Lesson Two: Addressing Systemic Risk Requires more than Just Information Sharing......Page 136
Acknowledgments......Page 137
Notes......Page 138
7.1 Introduction......Page 143
7.2 Cybersecurity......Page 145
7.3 Botnets......Page 147
7.3.2 Mitigating Existing Botnets......Page 148
7.3.3 Minimizing Criminal Profit......Page 149
7.4 Governance Theory......Page 150
7.5 Discussion: Governance Theory Applied to Botnet Mitigation......Page 153
7.6 Conclusion......Page 158
Notes......Page 159
8.1 Introduction......Page 163
8.2 Where Did Cyber Insurance Come From?......Page 165
8.2.3 Premiums......Page 166
8.2.5 Insurable Risk......Page 167
8.2.6 Comparisons to Terrorism......Page 168
8.3 Security Standards in the Governance Process......Page 169
8.3.1 Government-Developed Standards
......Page 170
8.3.2 Private Sector Standards......Page 171
8.4 The Key Role of Risk......Page 172
8.5 Enforcing Standards: Insurance Becomes Governance......Page 173
8.5.1 Model of Modern Market Governance......Page 174
8.5.2 Cyber Insurance: Governing Risk Through Standard Setting and Enforcement......Page 175
8.6 Conclusion and Implications......Page 177
Notes......Page 179
9.1 Introduction......Page 183
9.2 The Conficker Infection......Page 184
9.3.1 Populations, Not Individuals......Page 188
9.3.2 Shared and Overlapping Problems......Page 189
9.3.3 Balancing Efficacy and Individual Rights......Page 192
9.4 A Public Health Approach to Conficker......Page 195
Notes......Page 197
10.1 Introduction: Conspicuously Absent......Page 201
10.2 Scope and Aims......Page 202
10.3 A Market for Flaws: Bug Bounty Programs......Page 203
10.3.1 Case I, Microsoft: Rethinking the Market for Flaws......Page 204
10.3.2 Case II, Google: Matching the Wisdom of Crowds and the Wisdom of Experts......Page 206
10.3.3 Case III, Facebook: Transaction Costs and Reputational Benefits......Page 209
10.4 Conclusion......Page 211
Notes......Page 214
11.1 Introduction......Page 221
11.2.1 The Challenge to Law Enforcement......Page 223
11.2.2 Alternative Approaches to MLATs......Page 227
11.2.3.1 Content and Speech......Page 229
11.2.3.2 Privacy and Data Protection......Page 231
11.3 The Threat of Data Localization......Page 232
11.4 A New Approach to Data Flow Controls......Page 233
11.4.1 Control Points Analysis......Page 234
11.4.2 A Common Framework for Data Flow Controls......Page 235
11.5.1 Recommendation One: Establish a Common Framework for Data Flow Controls Through the Development of International Standards, Norms, and Principles......Page 238
11.5.2 Recommendation Two: Formalize Agreed-upon Standards, Norms, and Principles Through the Adoption of Voluntary and Treaty‐Based International Agreements
......Page 240
11.5.3 Recommendation Three: Reform Domestic Law and Policy Frameworks Consistent with Agreed‐upon Standards, Norms, and Principles......Page 241
11.5.4 Recommendation Four: Focus First on Specific Policy Matters of Broad International Consensus, Then Move on to the more Contentious Issues......Page 242
11.6 Additional Challenges......Page 243
Acknowledgments......Page 244
Notes......Page 245
12.1 Introduction......Page 257
12.2.1.1 The CFAA......Page 260
12.2.1.3 The Department of Justice Framework for a Vulnerability Disclosure Program for Online Systems......Page 261
12.2.2 Bug Bounty Legal Terms: General Structure......Page 262
12.2.3 The Bug Bounty Catch 22......Page 264
12.2.4 Safe Harbor Language Matters......Page 266
12.3.1 Increase of Terms Salience......Page 268
12.3.2 Clear Safe Harbor Language......Page 269
12.3.3 Standardization of Bug Bounty Legal Terms Across Platforms, Industries, and Sponsors......Page 270
12.3.4 Improved Disclosures and Educational Efforts......Page 271
12.4 Conclusion......Page 272
Notes......Page 273
Bibliography......Page 291
Index......Page 341
EULA......Page 354