Identifying and Prioritizing Systemically Important Entities : Advancing Critical Infrastructure Security and Resilience /
John Bordeaux, Jonathan W. Welburn, Sasha Romanosky, Benjamin Boudreaux, Aaron Strong, Shannon Prier, Cheryl K. Montemayor, Jhacova Williams, Jessica Welburn Paige, Michael J. D. Vermeer, Zev Winkelman.
Bok Engelsk 2023
| Annen tittel | |
|---|---|
| Utgitt | RAND Corporation , 2023
|
| Opplysninger | Chapter One: Introduction -- Chapter Two: Background and Motivation on Systemic Importance -- Chapter Three: Systemically Important Entities : Identification and Prioritization -- Chapter Four: Systemic Cyber Risk -- Chapter Five: Future Research -- Appendix A: Systemic Importance Analytic Model -- Appendix B: Cybersecurity and Infrastructure Security Agency Strategic Intent and National Risk Management Center Missions and Objectives -- Appendix C: Cyber Data and Software Dependencies -- Appendix D: Analytical Support for the Cybersecurity and Infrastructure Security Agency.. - In response to the mounting specter of systemic cyber risks, the Cyberspace Solarium Commission recommended that Congress codify the concept of Systemically Important Critical Infrastructure—later renamed Systemically Important Entities (SIEs)—and that the Cybersecurity and Infrastructure Security Agency (CISA) be resourced to identify SIEs and support in the mitigation of their risks to support a broader national strategy of layered deterrence. In support of the CISA National Risk Management Center (NRMC), this report clarifies the concepts of SIEs and introduces a data-driven methodology for their identification and prioritization. Specifically, the authors identify SIEs by their potential to affect national critical functions (NCFs) and prioritize SIEs by measures of their size and interconnectedness. This report builds on existing work regarding Critical IT Products and Services and extending the researchers' analysis to federal agencies and firms that install potentially vulnerable software, in addition to firms that write software. This report further documents systemic risks and cyber risks in software supply chains, past and ongoing analytical support to CISA, and current limitations, and it outlines a path for future work.
|
| Emner | |
| Geografisk emneord | |
| Dewey |
