Multicriteria Decision Framework for Cybersecurity Risk Assessment and Management.

Risk assessors and managers face many difficult challenges related to novel cyber systems. Among these challenges are the constantly changing nature of cyber systems caused by technical advances, their distribution across the physical, information, and sociocognitive domains, and the complex network structures often including thousands of nodes. Here, we review probabilistic and risk-based decision-making techniques applied to cyber systems and conclude that existing approaches typically do not address all components of the risk assessment triplet (threat, vulnerability, consequence) and lack the ability to integrate across multiple domains of cyber systems to provide guidance for enhancing cybersecurity. We present a decision-analysis-based approach that quantifies threat, vulnerability, and consequences through a set of criteria designed to assess the overall utility of cybersecurity management alternatives. The proposed framework bridges the gap between risk assessment and risk management, allowing an analyst to ensure a structured and transparent process of selecting risk management alternatives. The use of this technique is illustrated for a hypothetical, but realistic, case study exemplifying the process of evaluating and ranking five cybersecurity enhancement strategies. The approach presented does not necessarily eliminate biases and subjectivity necessary for selecting countermeasures, but provides justifiable methods for selecting risk management actions consistent with stakeholder and decisionmaker values and technical data.

Resilience and sustainability: Similarities and differences in environmental management applications.

In recent years there have been many disparate uses of the terms sustainability and resilience, with some framing sustainability and resilience as the same concept, and others claiming them to be entirely different and unrelated. To investigate similarities, differences, and current management frameworks for increasing sustainability and resilience, a literature review was undertaken that focused on integrated use of sustainability and resilience in an environmental management context. Sustainability was defined through the triple bottom line of environmental, social and economic system considerations. Resilience was viewed as the ability of a system to prepare for threats, absorb impacts, recover and adapt following persistent stress or a disruptive event. Three generalized management frameworks for organizing sustainability and resilience were found to dominate the literature: (1) resilience as a component of sustainability, (2) sustainability as a component of resilience, and (3) resilience and sustainability as separate objectives. Implementations of these frameworks were found to have common goals of providing benefits to people and the environment under normal and extreme operating conditions, with the best examples building on similarities and minimizing conflicts between resilience and sustainability.

Resilience and efficiency in transportation networks.

Urban transportation systems are vulnerable to congestion, accidents, weather, special events, and other costly delays. Whereas typical policy responses prioritize reduction of delays under normal conditions to improve the efficiency of urban road systems, analytic support for investments that improve resilience (defined as system recovery from additional disruptions) is still scarce. In this effort, we represent paved roads as a transportation network by mapping intersections to nodes and road segments between the intersections to links. We built road networks for 40 of the urban areas defined by the U.S. Census Bureau. We developed and calibrated a model to evaluate traffic delays using link loads. The loads may be regarded as traffic-based centrality measures, estimating the number of individuals using corresponding road segments. Efficiency was estimated as the average annual delay per peak-period auto commuter, and modeled results were found to be close to observed data, with the notable exception of New York City. Resilience was estimated as the change in efficiency resulting from roadway disruptions and was found to vary between cities, with increased delays due to a 5% random loss of road linkages ranging from 9.5% in Los Angeles to 56.0% in San Francisco. The results demonstrate that many urban road systems that operate inefficiently under normal conditions are nevertheless resilient to disruption, whereas some more efficient cities are more fragile. The implication is that resilience, not just efficiency, should be considered explicitly in roadway project selection and justify investment opportunities related to disaster and other disruptions.