Business continuity strategies for cyber defence: Battling time and information overload

John Streufert

Journal of Business Continuity & Emergency Planning, 2010, vol. 4, issue 4, 303-316

Abstract: Can the same numbers and letters which are the life blood of modern business and government computer systems be harnessed to protect computers from attack against known information security risks? For the past seven years, Foreign Service officers and technicians of the US Government have sought to maintain diplomatic operations in the face of rising cyber attacks and test the hypothesis that an ounce of prevention is worth a pound of cure. As eight out of ten attacks leverage known computer security vulnerabilities or configuration setting weaknesses, a pound of cure would seem to be easy to come by. Yet modern security tools present an unusually consequential threat to business continuity — too much rather than too little information on cyber problems is presented, harking back to a phenomenon cited by social scientists in the 1960s called ‘information overload’. Experience indicates that the longer the most serious cyber problems go untreated, the wider the attack surface adversaries can find. One technique used at the Department of State, called ‘risk scoring’, resulted in an 89 per cent overall reduction in measured risk over 12 months for the Department of State’s servers and personal computers. Later refinements of risk scoring enabled technicians to correct unique security threats with unprecedented speed. This paper explores how the use of metrics, special care in presenting information to technicians and executives alike, as well as tactical use of organisational incentives can result in stronger cyber defences protecting modern organisations.

Keywords: cybersecurity; risk; metrics; change; technology; executive (search for similar items in EconPapers)
JEL-codes: M1 M10 M12 (search for similar items in EconPapers)
Date: 2010
References: Add references at CitEc
Citations:

Downloads: (external link)
https://hstalks.com/article/818/download/ (application/pdf)
https://hstalks.com/article/818/ (text/html)
Requires a paid subscription for full access.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:aza:jbcep0:y:2010:v:4:i:4:p:303-316

Access Statistics for this article

More articles in Journal of Business Continuity & Emergency Planning from Henry Stewart Publications
Bibliographic data for series maintained by Henry Stewart Talks ().