How We Stopped Worrying about Cyber Doom and Started Collecting Data

Abstract

Moderate and measured takes on cyber security threats are swamped by the recent flood of research and policy positions in the cyber research field offering hyperbolic perspectives based on limited observations. This skewed perspective suggests constant cyber disasters that are confronting humanity constantly. The general tone of the debate argues that cyber war is already upon us and our future will only witness more cyber doom. However, these hyperbolic perspectives are being countered by empirical investigations that produce the opposite of what is to be expected. It is generally observed that limited cyber engagements throughout the geopolitical system are the dominant form of interaction. Our task here is to offer a different path forward. We first posit what can be known about cyber security interactions with data as well as what cannot. Where is the water's edge in cyber security research? We then examine the known works in the field that utilize data and evidence to examine cyber security processes. Finally, we conclude with an offering of what types of studies need to be done in the future to move the field forward, away from the prognostication and generalizations so typical in the discourse in this constantly changing and growing field.

Global Cybersecurity: New Directions in Theory and Methods

“…The authors point towards the fertile use of data-sets in cybersecurity research and recommend avenues for establishing data integrity and reliability. Gomez and Villar (2018) account for feelings of 'dread' that accompany the types of assumptions about cyber threats disputed by Valeriano and Maness (2018). From experimental data they find that imperfect information and lack of experience elevate actors' levels of uncertainty and likelihood of developing fearful reactions to cyber threats.…”

“…This is a significant corrective to conventional readings of cybersecurity as a 'top-down' venture by commercial and political elites. Valeriano and Maness (2018) and Gomez and Villar (2018) bring quantitative methods to bear on established cybersecurity problems. Valeriano and Maness (2018) report on a long-term project to gather data on international cyber conflict, through which to test hypotheses of state actions and intentions.…”

“…Valeriano and Maness (2018) and Gomez and Villar (2018) bring quantitative methods to bear on established cybersecurity problems. Valeriano and Maness (2018) report on a long-term project to gather data on international cyber conflict, through which to test hypotheses of state actions and intentions. Contrary to received wisdom, for example, they find that states are restrained in their use of offensive cyber capabilities, which explains the historical dearth of escalatory incidents.…”

An Acid Test for Europeanization: Public Cyber Security Procurement in the European Union

“…What is more, there is precious little empirical social science research on cyber security. While some attempts have been made for improving the situation (Valeriano and Maness 2018), none of the existing empirical state-centric studies on cyber security are convincing. The reason relates partially to the unsolvable problem about reliable and valid data, and partially to the nature of the Internet as a fundamentally non-Westphalian system.…”

Assessing nation‐state‐sponsored cyberattacks using aspects of Situational Crime Prevention

“…The larger majority of nation‐state cyberattacks appear focused on the acquisition of sensitive personal information and intellectual property from targets, along with indirect harm to individual victims as well as the costs associated with mitigation and repairs related to the attack (Andress & Winterfeld, 2013; Rid, 2013; Valeriano & Maness, 2018). For example, the U.S. Office of Personnel Management (OPM) was compromised by Chinese‐state‐sponsored hackers leading to the loss of more than 22 million individuals’ data during 2014 and 2015 (Fruhlinger, 2020).…”