PhD Proposal on Financial Stability, Critical Infrastructure and Cyber Security.

关于金融稳定、关键基础设施和网络安全的博士提案。

• 批准号: 2888135
• 金额: --
• 依托单位: Durham University
• 依托单位国家: 英国
• 项目类别: Studentship
• 财政年份: 2023
• 资助国家: 英国
• 起止时间: 2023 至 无数据
• 项目状态: 未结题
• 来源: https://gtr.ukri.org/projects?ref=studentship-2888135
• 关键词: PhD; Proposal; Financial; Stability; Critical

The information security of critical national infrastructure assets (CNI) such as energy grids, telecommunications networks and road transport infrastructure is of significant import to the economic security of the UK and its partners. In most cases private organizations (usually firms) are either contracted or sub-contracted to operate those assets under some form of licence. Those organizations need to make strategic investments in their security and adjust their security posture when an attack occurs. The tension and object of research is driven by the observation that the level of damage that could be inflicted on society may far exceed the losses incurred by the infrastructure provider (e.g, the value of traded assets far exceeds the value of a typical financial exchange like the LSE or NYMEX and the economic output lost to a prolonged power cut is normally significantly higher than the value of the infrastructure provider). In these cases, there is a need for legislative remedies to incentivize appropriate cyber security postures to reflect the risk preferences of society at large. This is not new, the General Data Protection Regulation is a well-known example for firms storing individual information. However, the current design of security regulation is mostly directed at privacy, rather than the secure operation of the infrastructure assets. In this thesis I will focus on the design of regulatory mechanisms needed to incentivize appropriate and well directed investment in cyber security risk management for CNI operators using economic theory and empirical analysis on firm and operational level data.

关键国家基础设施资产（CNI）的信息安全，如能源电网、电信网络和道路运输基础设施，对英国及其合作伙伴的经济安全具有重要意义。在大多数情况下，私人组织（通常是公司）在某种形式的许可证下承包或分包经营这些资产。这些组织需要对其安全性进行战略投资，并在攻击发生时调整其安全态势。这种紧张和研究对象是由观察到可能对社会造成的损害程度可能远远超过基础设施提供商所造成的损失（例如，交易资产的价值远远超过伦敦证券交易所或纽约商品交易所等典型金融交易所的价值，长期停电造成的经济产出损失通常显著高于基础设施提供商的价值）所驱动的。在这些情况下，需要立法补救措施来激励适当的网络安全姿态，以反映整个社会的风险偏好。这并不新鲜，《通用数据保护条例》是公司存储个人信息的一个众所周知的例子。然而，目前的安全监管设计主要针对隐私，而不是基础设施资产的安全运营。在本文中，我将重点关注监管机制的设计，以激励CNI运营商在网络安全风险管理方面进行适当和有针对性的投资，使用经济理论和对企业和运营层面数据的实证分析。