Managing Response to Significant Cyber Incidents: Comparing Event Life Cycles and Incident Response Across Cyber and Non-Cyber Events

Format:

• Book

Author/Creator:

• Hodgson, Quentin E.

Contributor:

• United States. Cybersecurity & Infrastructure Security Agency
• Rand Corporation. Homeland Security Operational Analysis Center
• Clark-Ginsberg, Aaron
• Haldeman, Zachary
• Lauland, Andrew
• Mitch, Ian

Language:

English

Subjects (All):

• Cyberinfrastructure--Security measures--United States--Evaluation.
• Computer networks--Security measures--United States.

Other Title:

Managing Response to Significant Cyber Incidents

Place of Publication:

RAND Corporation 2022

Summary:

Cyber incident response has evolved based on systems and processes developed for other types of incident response, such as response to natural hazards. Large-scale cyber incidents that would have an impact on the United States' national and homeland security, economic security, and public safety and welfare to date are rare. However, they may have additional complications that make them more complex to plan for, including challenges in distinguishing the early stages of a significant cyber incident from a more quotidian incident, and the diversity of stakeholders involved. In this report, RAND researchers compare and contrast incident response for cyber and other types of hazards, both human-caused and natural, to derive initial insights into their similarities and distinctions. The report suggests some ways to improve preparedness for cyber incident response and propose additional areas requiring further research. Recommendations include developing more rigorous and dynamic joint public-private exercises, conducting further analysis to identify how systems could fail through a cyber attack to inform early warning efforts, and developing decision mechanisms and shared understandings that will facilitate coordinated activation and execution of incident response plans.

Contents:

• CHAPTER ONE: Introduction
• CHAPTER TWO: Key Features of Non-Cyber Incidents
• CHAPTER THREE: Life Cycle of Significant Cyber Incidents
• CHAPTER FOUR: Cross-Incident Analysis
• CHAPTER FIVE: Recommendations and Areas for Future Research.