Cyberattacks on Critical Infrastructure: an Economic Perspective

Abstract

The aim of this article is to analyze the economic aspects of cybersecurity of critical infrastructure defined as physical or virtual systems and assets that are vital to a country's functioning and whose incapacitation or destruction would have a debilitating impact on national, economic, military and public security. The functioning of modern states, firms and individuals increasingly relies on digital or cyber technologies and this trend has also materialized in various facets of critical infrastructure. Critical infrastructure presents a new cybersecurity area of attacks and threats that requires the attention of regulators and service providers. Deploying critical infrastructure systems without suitable cybersecurity might make them vulnerable to intrinsic failures or malicious attacks and result in serious negative consequences. In this article a fuller view of costs and losses associated with cyberattacks that includes both private and external (social) costs is proposed. An application of the cost-benefit analysis or the Return on Security Investment (ROSI) indicator is presented to evaluate the worthiness of cybersecurity efforts and analyze the costs associated with some major cyberattacks in recent years. The "Identify, Protect, Detect, Respond and Recover" (IPDRR) framework of organizing cybersecurity efforts is also proposed as well as an illustration as to how the blockchain technology could be utilized to improve security and efficiency within a critical infrastructure.

A Bayesian Network Approach to Hybrid Threat Modelling

“…The potential impacts of cyber attacks are inspired by the research of [41], where we draw the most damaging impact θ 1 and the substantial impact θ 2 from the truncated normal distributions f (x, µ 1 , σ 1 , a, b) and f (x, µ 2 , σ 2 , a, b) respectively, where a = 0 , µ 1 , µ 2 = 1000, 100 and σ 1 , σ 2 = 300, 50 respectively. Negligible damaging impact θ 3 is drawn from a half-normal distribution based on normal distribution N (0, 5).…”

“…• θ 3 Impact from cyber attacks on critical infrastructure leading to limited or negligible effects by reason of the defender's ability to preventively detect and/or recover from the attack. Since entities targeted by malicious cyber attacks are reluctant to share information about their precise impact, we have constructed heavy-tailed half-normal distributions based on the research of [41] to sample the potential impact, θ 1 , θ 2 , θ 3 for each of the three classes of malicious cyber-attacks. Drawing from distributions with high variance, which are specified in Appendix A, helps to account for the variability and lack of consensus on the potential impact of a cyber attack.…”

Reviewing the Health Care Impacts of Attacks on Critical Infrastructure

“…44 Taubman © 2023 Prehospital and Disaster Medicine Health care is particularly vulnerable to cyberattacks and is one of the most frequently targeted and costly entities, with an average total cost of US$10.1 million per breach in the United States. 45 The proliferation of EMRs, telehealth capabilities, and network-based equipment have increased efficiency and improved health care delivery. 41 However, increasing dependency on these systems makes them more vulnerable to disruption via cyberattacks.…”

Cyber Risk Frequency, Severity and Insurance Viability

“…The manner in which we have performed the analysis also allows us to provide insights with respect to the risk appetite and insurance cost on a firm by firm basis. This enhances the types of economic analysis undertaken in work such as Lis and Mendel (2019).…”