CRE 2018 - IEEE International Workshop on Cyber Resilience Economics

A combination of cyber technological feasibility and economic viability drives many of the decisions related to cybersecurity by both the defenders and attackers. In this context, technological feasibility is defined as any cyber resiliency technology that has the potential to be developed, fielded, and operationally controlled. In the case of economic viability, the resources required to defend or attack must be available. We define resources in its broadest sense to include but not limited to the people, equipment, training, required funding, and asset value. On the defensive side, these technological and economic factors determine the cyber security and resiliency policies, procedure and technologies implemented to prevent and respond to cyber-attacks. On the offensive side, they not only determines the type of attack but also the effort expended to ensure its success. In short, these and other factors determine the asymmetric balance between the attackers and defenders.
The CRE18 Workshop on Cyber Resilience Technologies, Benefits and Measurements will explore foundational and applied advances in cyber resiliency policies and technologies to achieve an asymmetric balance, and identify and quantify the effect economics has on the decision process. To do so, the workshop will seek to understand the capabilities, strengths/weaknesses, and benefits of various resiliency technologies. In addition it will attempt to address the metrics needed to measure their technical and economic effectiveness in addressing the asymmetric disparity between defender and attacker. The workshop will examine the parameters needed to accurately quantify asymmetric imbalance from both the offensive and defensive perspective; examine technical and non-technical approaches to shifting that balance, including the full range of costs/benefits of each approach; and explore and evaluate a range of options for defining and achieving optimality. It will bring together a diverse group of experts from multiple fields to advance the concepts, analysis and application of cost, value, risk and other important features of cyber systems as related to asymmetric advantage and cyber resiliency. This will serve to accelerate the recognition, adoption and application of cyber resilience within industry, government and academia by addressing the key concerns of how these techniques and technologies can be realized within the practical constraints of cost, risk, and benefit.
The topics of interest include, but are not limited to:
Cyber Resiliency technologies
Benefits and weaknesses of cyber resiliency technologies
Foundations of asymmetric cyber advantage
Integrated analyses of cyber resiliency & asymmetry with cyber environments
Metrics, measures, and economics of cyber resiliency & asymmetry
Policies and procedures related to the development, deployment and use of cyber resiliency technologies
Defining practical cyber resiliency
Technical & architectural approaches to gaining asymmetric advantage
Relationship between resiliency and security
Adversary economics: assessing the impact of defender capabilities and actions to the attacker
Frameworks for ROI analysis (cost, risk, benefit) to guide technology investment (research, development, and utilization)
Cyber-resiliency related tools that are guided by economic factors for defender and/or adversary
Use cases or case studies for defender and/or adversary that include economic factors
Cyber resiliency is applicable across the entire software architecture and how that architecture is implemented. As a result, this workshop is interested in the above topics as they relate across the entire software stack for both Information Technology (IT) and Operational Technology (OT).