A framework for linking cybersecurity metrics to the modeling of macroeconomic interdependencies

Risk Analysis

Volumn 27, Issue 5, 2007, Pages 1283-1297

  Santos, Joost R ^a,c   Haimes, Yacov Y ^a   Lian, Chenyang ^b  

^a UNIVERSITY OF VIRGINIA   (United States)

^b FAIR ISAAC CORPORATION   (United States)

^c University of Virginia   (United States)

Author keywords

Cybersecurity; Disaster analysis; Dynamic modeling; Input output analysis; Interdependencies; Metrics; Risk management

Indexed keywords

DISASTER ANALYSIS; METRICS;

DECISION MAKING; ECONOMIC ANALYSIS; HIERARCHICAL SYSTEMS; RISK MANAGEMENT;

RISK ANALYSIS;

DECISION MAKING; DISASTER MANAGEMENT; ECONOMIC IMPACT; GAS INDUSTRY; HIERARCHICAL SYSTEM; INFORMATION SYSTEM; INFRASTRUCTURE PLANNING; INPUT-OUTPUT ANALYSIS; INTERNET; MACROECONOMICS; MODELING; NATURAL DISASTER; OIL INDUSTRY; RISK ASSESSMENT; SECURITY THREAT; STAKEHOLDER; TERRORISM;

COST BENEFIT ANALYSIS; DECISION MAKING; DISASTER; ECONOMIC DEVELOPMENT; INFORMATION SYSTEM; REVIEW; RISK BENEFIT ANALYSIS; SOCIAL DOMINANCE; SOCIAL SECURITY;

GULF COAST [UNITED STATES]; NORTH AMERICA; UNITED STATES;

EID: 36849039045     PISSN: 02724332     EISSN: 15396924     Source Type: Journal    
DOI: 10.1111/j.1539-6924.2007.00957.x     Document Type: Review

References (45)

1. ® Approach. Networked Systems Survivability Program. Pittsburgh, PA Software Engineering Institute.
2. Allen J., Alberts, C., Behrens, S., Laswell, B., & Wilson, W. (2000). Improving the security of networked systems. Journal of Defense Software Engineering, October 2000. Available at : http://www.stsc.hill.af.mil/CrossTalk/ 2000/10/allen.html.
3. American National Standards Institute/Instrumentation, Systems, and Automation (ANSI/ISA) 2004). Integrating Electronic Security into the Manufacturing and Control Systems Environment. ANSI/ISA-TR99.00.02-2004. Research Triangle Park, NC.
4. American Petroleum Institute (API) 2003). Security Guidelines for the Petroleum Industry. Available at http://api-ec.api.org/filelibrary/ Security_Guidance2003.pdf.
5. Anderson P., & Geckil, I. (2003). Northeast Blackout Likely to Reduce US Earnings by $6.4 Billion. Anderson Economic Group Working Paper AEG 2003-2. Available at http://www.andersoneconomicgroup.com/modules.php?name= Content&pa=display_aeg&doc_ID=664.
6. Bailey, D., & Wright, E. (2003). Practical SCADA for Industry. Oxford, UK : Newnes.
7. BEA 1998). Benchmark Input-Output Accounts of the United States for 1992. Washington, DC : US Department of Commerce.
8. Bureau of Economic Analysis (BEA) 1997). Regional Multipliers: A User Handbook for the Regional Input-Output Modeling System (RIMS II). Washington, DC : US Department of Commerce.
9. Cho, S., Gordon, P., Moore, J. E. II., Richardson, H. W., Shinozuka, M., & Chang, S. (2001). Integrating transportation network and regional economic models to estimate the costs of a large urban earthquake. Journal of Regional Science, 41, 39 65.
10. Christie, A., Durkee, D., Fisher, D., & Mundie, D. (2003). Easel Language Reference Manual and Author's Guide. Networked Systems Survivability Program. Pittsburgh, PA : Software Engineering Institute.
11. Department of the Army 1991). FM 34-36: Special Operations Forces Intelligence and Electronic Warfare Operations. Army Headquarters, Washington DC. Available at http://www.fas.org/irp/doddir/army/fm34 - 36/appd.htm.
12. Department of the Army 2003). Joint Tactics, Techniques, and Procedures for Special Operations Targeting Mission Planning. Joint Publication 3-05.2. Washington, DC: Joint Chiefs of Staff. Available at http://www.dtic.mil/ doctrine/jel/new_pubs/jp3_05_2print.pdf.
13. Department of Homeland Security (DHS) 2006). National Infrastructure Protection Plan. Available at http://www.dhs.gov/interweb/assetlibrary/ NIPP_Plan.pdf.
14. Dietzenbacher, E., & Lahr, M. L. (2004). Wassily Leontief and Input-Output Economics. Cambridge, UK : Cambridge University Press.
15. Edwards, K. (2005). Study: Spam Costing Companies $22 Billion a Year. Available at http://blogcritics.org/archives/2005/02/05/010437.php.
16. Government Accountability Office (GAO) 2002). Review of Studies of the Economic Impact of the September 11, 2001 Terrorist Attacks on the World Trade Center. Washington, DC : GAO.
17. Haimes, Y. Y. (2002). Roadmap for modeling risks of terrorism to the homeland. Journal of Infrastructure Systems, 8 (2 35 41.
18. Haimes, Y. Y., Horowitz, B. M., Lambert, J. H., Santos, J. R., Crowther, K. G., & Lian, C. (2005b). Inoperability input-output model (IIM) for interdependent infrastructure sectors: Case study. Journal of Infrastructure Systems, 11, 80 92.
19. Haimes, Y. Y., Horowitz, B. M., Lambert, J. H., Santos, J. R., Lian, C., & Crowther, K. G. (2005a). Inoperability input-output model (IIM) for interdependent infrastructure sectors: Theory and methodology. Journal of Infrastructure Systems, 11, 67 79.
20. Haimes Y. Y., & Jiang, P. (2001). Leontief-based model of risk in complex interconnected infrastructures. Journal of Infrastructure Systems, 7, 1 12.
21. Haimes, Y. Y., Kaplan, S., & Lambert, J. H. (2002). Risk filtering, ranking, and management framework using hierarchical holographic modeling. Risk Analysis, 22 (2 383 397.
22. Howard J. (1997). An Analysis of Security Incidents on the Internet, 1989-1995. Ph.D. Dissertation, Department of Engineering and Public Policy, Carnegie Mellon University, Pittsburgh, PA.
23. Howe, D. (2004). Homeland Security Council: Planning Scenarios. Available at http://www.voiceoffreedom.com/archives/homelandsecurity/15- attacks_the_hawiaa_disclosure.htm.
24. Homeland Security Presidential Directive-5 (HSPD-5) 2003). Management of Domestic Incidents. Retrieved April 3, 2006 from http://www.whitehouse.gov/news/ releases/2003/02/20030228-9.html.
25. HSPD-7 2003). Critical Infrastructure Identification, Prioritization, and Protection. Available at http://www.whitehouse.gov/news/releases/2003/12/ 20031217-5.html.
26. Lahr, M. L., & Dietzenbacher, E. (2001). Input-Output Analysis: Frontiers and Extensions. New York : Palgrave.
27. Lawson, A. M. (1997). Benchmark input-output accounts for the US economy. Survey of Current Business, 77, 36 82.
28. Leontief, W. W. (1951a). Input-output economics. Scientific American, 10, 15 21.
29. Leontief, W. W. (1951b). The Structure of the American Economy, 1919-1939: An Empirical Application of Equilibrium Analysis, 2nd ed. New York : International Arts and Sciences Press.
30. McLure, S., Scambray, J., & Kurtz, G. (2003). Hacking Exposed: Network Security Secrets & Solutions, Fourth Edition. Berkeley, CA : Osborne/McGraw-Hill.
31. Miller, R. E., & Blair, P. D. (1985). Input-Output Analysis: Foundations and Extensions. Englewood Cliffs, NJ : Prentice-Hall.
32. National Institute of Standards and Technology (NIST) 2003). Security Metrics Guide for Information Technology Systems. NIST Special Publication 800-55. Gaithersburg, MD: National Institute of Standards and Technology.
33. National Research Council (NRC) 1999). Trust in Cyberspace. Committee on Information System Trustworthiness, National Research Council. Washington, DC : National Academy Press.
34. National Transportation Safety Board (NTSB) 2002). Pipeline Accident Report: Pipeline Rupture and Subsequent Fire in Bellingham, Washington, June 10, 1999. Washington, DC : National Transportation Safety Board.
35. NRC 2002). Making the Nation Safer. Washington, DC : National Academy Press.
36. RAND 2003). Finding and Fixing Vulnerabilities in Information Systems: The Vulnerability Assessment and Mitigation Methodology. Document information available at http://www.rand.org/pubs/monograph_reports/MR1601/.
37. Rose, A. (2004). Economic principles, issues, and research priorities in hazard loss estimation. In Y. Okuyama & S. Chang (Eds. Modeling Spatial and Economic Impacts of Disasters (pp. 13 36). New York : Springer-Verlag.
38. Rose, A., & Liao, S. (2005). Modeling regional economic resilience to disasters: A computable general equilibrium analysis of water service disruptions. Journal of Regional Science, 45, 75 112.
39. Santos, J. R. (2006). Inoperability input-output modeling of disruptions to interdependent economic systems. Systems Engineering, 9 (1 20 34.
40. Santos, J. R., & Haimes, Y. Y. (2004). Modeling the demand reduction input-output inoperability due to terrorism of interconnected infrastructures. Risk Analysis, 24, 1437 1451.
41. Tan, Y. S., & Fraser, N. M. (1998). The modified star graph and the petal diagram: Two new visual aids for discrete alternative multicriteria decision making. Journal of Multicriteria Decision Analysis, 7, 20 33.
42. Tidwell T., Larson, R., Fitch, K., & Hale, J. (2001). Modeling internet attacks. Proceedings of 2001 IEEE Workshop on Information Assurance and Security, United States Military Academy, West Point, NY. Available at http://www.itoc.usma.edu/Workshop/2001/Authors/SubmittedAbstracts/paperT1C1(50). pdf.
43. Turk, A., Raynor, R., Corbet, T., Conrad, S., Beyeler, W., & Brown, T. (1989). Simulated nation-wide consequences of disruptions to the petroleum industry in the western US gulf coast. In Petroleum Storage & Transportation. National Petroleum Council.
44. Wulf, W., & Jones, A. (2004). A perspective on cybersecurity research in the United States. In Terrorism: Reducing Vulnerabilities and Improving Responses. Washington, DC : National Research Council of the National Academies.
45. Zimmerman, R., & Horan, T., Eds 2004). Digital Infrastructures: Enabling Civil and Environmental Systems Through Information Technology. London, UK : Routledge.