A framework for linking cybersecurity metrics to the modeling of macroeconomic interdependencies.

Hierarchical decision making is a multidimensional process involving management of multiple objectives (with associated metrics and tradeoffs in terms of costs, benefits, and risks), which span various levels of a large-scale system. The nation is a hierarchical system as it consists multiple classes of decisionmakers and stakeholders ranging from national policymakers to operators of specific critical infrastructure subsystems. Critical infrastructures (e.g., transportation, telecommunications, power, banking, etc.) are highly complex and interconnected. These interconnections take the form of flows of information, shared security, and physical flows of commodities, among others. In recent years, economic and infrastructure sectors have become increasingly dependent on networked information systems for efficient operations and timely delivery of products and services. In order to ensure the stability, sustainability, and operability of our critical economic and infrastructure sectors, it is imperative to understand their inherent physical and economic linkages, in addition to their cyber interdependencies. An interdependency model based on a transformation of the Leontief input-output (I-O) model can be used for modeling: (1) the steady-state economic effects triggered by a consumption shift in a given sector (or set of sectors); and (2) the resulting ripple effects to other sectors. The inoperability metric is calculated for each sector; this is achieved by converting the economic impact (typically in monetary units) into a percentage value relative to the size of the sector. Disruptive events such as terrorist attacks, natural disasters, and large-scale accidents have historically shown cascading effects on both consumption and production. Hence, a dynamic model extension is necessary to demonstrate the interplay between combined demand and supply effects. The result is a foundational framework for modeling cybersecurity scenarios for the oil and gas sector. A hypothetical case study examines a cyber attack that causes a 5-week shortfall in the crude oil supply in the Gulf Coast area.

Extreme risk analysis of interdependent economic and infrastructure sectors.

Willful attacks or natural disasters pose extreme risks to sectors of the economy. An extreme-event analysis extension is proposed for the Inoperability Input-Output Model (IIM) and the Dynamic IIM (DIIM), which are analytical methodologies for assessing the propagated consequences of initial disruptions to a set of sectors. The article discusses two major risk categories that the economy typically experiences following extreme events: (i) significant changes in consumption patterns due to lingering public fear and (ii) adjustments to the production outputs of the interdependent economic sectors that are necessary to match prevailing consumption levels during the recovery period. Probability distributions associated with changes in the consumption of directly affected sectors are generated based on trends, forecasts, and expert evidence to assess the expected losses of the economy. Analytical formulations are derived to quantify the extreme risks associated with a set of initially affected sectors. In addition, Monte Carlo simulation is used to handle the more complex calculations required for a larger set of sectors and general types of probability distributions. A two-sector example is provided at the end of the article to illustrate the proposed extreme risk model formulations.