Week 10 Exercises: Cybersecurity Policy
Today, we start thinking about how policy gets created, and what some of the general challenges around policy are.
When facing a situation, first we should try to see if any of the social science ideas from class apply to that situation:
- Are defenders working together? If so, is it Best shot vs. weakest link vs. total effort situation
- Are there Externalities – does the wrong person suffers harm (who isn’t making the decision leading to the harm)
- Free riding – letting others be resonsible
- Information asymmetry – who knows what?
Potential Policy Options
- Regulation: Require information sharing in specific situations.
- Challenge: Which situations? How to enforce? Is it enough to solve information asymmetry problem?
- Challenge: Inefficient; everyone has to do a lot of work!
- Lemons Laws: Have a minimum standard of quality, and require companies to compensate people who receive defective products
- Challenge: Raises floor, but still means most/all products are at the floor
- Challenge: Must have clearly defined “quality” measures
- Signalling: People with information can find a way to credibly signal their information
- Example: School signals that you are the kind of person that school is easier for
- Challenge: Only works if people can credibly signal, and if others can understand signals
- Warranties: People with good products can offer a warranty for defects.
- What is the equivalent of a warranty in cybersecurity? How can you define a “defect”?
- Insurance: People with less information can buy insurance to cover losses
- Usually requires protective measures – brings everyone up to a minimum
- Challenge: Doesn’t work with correlated risks
- Liability: People who make decisions are responsible for consequences of those decisions
- Challenge: Who should be liable in complex situations?
Policy Categories
All of these policy solutions can be grouped into two categories:
| Ex Ante | Ex Post | |
|---|---|---|
| When they are enforced | Before attacks occur | After attacks occur |
| Incentive | Regulation (rules) | Liability |
| How they work | Always follow required processes | Only matters when there is an attack |
| Benefits | Easier to tell if followed | Difficult to tell if not working |
| When costs happen | Regular budget (low risk) | Only when attacked (high risk) |
| Challenge | What rules will stop attacks? | Will liability be enough to motivate security? |
| Doesn’t work when | Lack info about harms, protections | Firms can’t be held liable, or can’t pay enough |
Getting Defenders to work together
When there are multiple defenders whose work together determines how secure something is (most real-world situations), then that work can combine in different ways – Best Shot, Weakest Link, or Total Effort being the most common. Different types of policy solutions are needed in these different situations.
| Weakest Link | Best Shot | Total Effort | |
|---|---|---|---|
| How it works | whoever works least | whoever works hardest | everyone combined |
| Who determines? | lowest benefit/cost | highest benefit/cost | highest benefit/cost |
| Who does work? | everyone | only champion | only champion? |
| Works best for | small groups | anyone | big groups |
| How to make it better | Negligence Rule | Liability | Liability |
| Easy to disrupt? | yes | ??? | No |
Scenarios
Below are a number of real-world-like cybersecurity scenarios. Our goal today is to try to understand them and brainstorm possible policy solutions. Is there some rule or policy or law that we can put in place that will help avoide the problems currently in the situation?
The challenge in a lot of the situations is that there is no one person or organization that controls things. The problems and vulnerabilities happen through complex interactions between lots of different people and organizations, and no individual person or organization wants to change what they are doing.
To help us think through some of thse situations, I created a Policy worksheet.
Fill out a copy of this worksheet for each of the following situations, and try to use it to understand and think through what the real policy challenges are in each situation.
The Bank Hacker
The FBI gets a call from a small regional bank – UW Credit Union. The bank informs the FBI that some hacker has broken into a number of accounts at the bank, and is threatening to steal money from bank customers unless the bank pays the hacker a ransom. The FBI suspects that other banks might also be targets of this same hacker. The FBI contacts a number of other banks in the area, and asks them if they have also been targetted. They all have the same response: “No, of course not! And even if we were, we wouldn’t tell anyone because then people would move their money away from us to another bank.”
The FBI needs information about banks being targetted or hacked, but the banks are not willing to provide that information out of fear that they will lose business. What can be done?
Company IT Firewall
Your company is trying to protect itself from outside hackers who are trying to break in and steal data from you. To protect itself, your company has decided to create a “network perimeter”: an imaginary line separating what is “inside” the company from the “outside”. There is a firewall that lies between the outside Internet and all of the computers inside the company. Any computer inside the company can talk to or access any other computer that is inside the company easily. But if a computer that is outside the company wants to access a computer that is inside, it must go through a very complicated authentication process to prove that it is allowed to. Only computers physically inside the company headquarters building are considered to be “inside” the company network.
The company has hundreds of different computers inside the company, each of which is used by a different employee. Some of them are up-to-date, and some of them are running old operating systems or old software, because that is what is needed to do company business. The IT department is concerned because if any of these computers is compromised by a hacker, then they can easily get access to all of the other computers inside the company. What should the company do?
Stressors / Booters
On the Internet, there are a number of websites that are known as either “stressors” or “booters”. Basically, what these websites do is that they run (or have access to) a large number of computers around the Internet. A customer can come to the stressor and ask the stressor website to “stress test” their website. The stressor will then have all of their large number of computers try to access the target of the stress test at the same time – in theory, testing how well the website handles it when it gets a LOT of attention and traffic.
Most of the “stressor” or “booter” websites, though, don’t actually verify that the target of the stress test is actually owned by the person or company paying for the stress test. This allows a bad actor to falsely claim that they own any website, and the stressor will then direct a LOT of traffic to the target, which causes the target to be overwhelmed and lose their Internet connection.
One common use of the stressor websites is by malicious gamers. Gamer A will get pissed off at Gamer B, and will go to the stressor website while Gamer B is playing their game. Gamer A will pay for a stress test of Gamer B’s computer – which the stressor would then happily do. This large amount of traffic would overwhelm Gamer B’s network connection, preventing them from being able to play the game. This effectively forcefully “boots” Gamer B off of the game (hence the other name for these websites – “booters”).
Game companies and ISPs don’t like these stressor websites. But the stressor websites claim that they provide a service to companies that need stress tests, and that they are perfectly legal. Some are even run by enterprising university students. What can be done about these?