No abstract

No abstract

Defense capability planning traditionally uses scenario-based war-gaming to support force design decision making and to prioritize investment. Some aspects of cyber warfare are problematic for war-gaming, such as poor characterization of cyber effects and difficulty estimating the true capability of own and opposing forces. In addition, strategic-level assessments typically draw on the expert judgment of senior officers, whose tactical experience likely precedes cyber warfare, and this will limit their intuition in the emerging cyber domain. Risk analysis, and specifically the strategic risk framework, is an alternative approach to prioritizing investment in cyber capabilities, which is well-suited to analysis of cross-domain and whole-of-government functions. This paper illustrates the application of risk analysis to cyber risk for the novel purpose of developing insights for whole-of-force capability analysis.

A method for risk-informed comparison of mitigation options in situations with large epistemological uncertainties is presented by example: that of an improvised explosive device (IED) attack at a generic airport frontof-house (FoH). Specifically, a probabilistic model is built and distributions of scaled fatalities from probabilistic combinations of vehicle-based IED and personnel-based IED threats are generated using Monte Carlo methods. A risk assessment of the threats is given from the statistics of the scaled fatality distributions. We consider the risk reduction due to a combination of mitigation options, including IED screening, vehicle stand-off, and interception and detection. Sensitivity and stress analysis show that the ranking of the options, by their risk reduction, is relatively robust to the epistemological uncertainty incorporated into the model. The qualified conclusion of the example is that vehicle stand-off is the priority risk-effective mitigation option for IED attack at a generic FoH.