Evaluating Cyber Security Evidence for Policy Advice: The Other Human Dimension

一个国家应对网络安全挑战的能力的好坏，正迅速被视为全球竞争力的一个重要因素。该项目旨在了解英国政策制定者在解释、评估和理解有关网络安全的证据方面面临的挑战。政策制定者有时几乎没有相关专业知识，而且通常在时间紧迫的情况下，他们被要求评估来自各种来源的证据，包括官方威胁情报、学术来源和行业威胁报告。然后，这种多样化的证据基础被用来对威胁、风险、缓解和后果做出判断，并提供塑造国家监管格局、外国和国内安全政策以及一系列公共和私营部门举措的建议。人的层面的这一要素与英国的网络安全具有重大相关性，也是本提案的主要重点。在这方面，评估证据是政策制定的一个特殊问题，原因有三：第一，有些证据相互矛盾，并且/或可能带有特定的议程或目标，这可能会妨碍其严密性和可靠性。网络安全证据的“政治化”越来越成问题，因为各国有时会优先考虑来自主权边界内来源的威胁情报，而不是基于它们所做研究的质量；其次，事实证明，对网络攻击进行最终归类和量化网络不安全的成本是极其困难的。这些挑战意味着，证据只能在一定程度上支持政策制定者对网络安全风险、威胁和后果的决策和评估；最后，网络安全格局正在迅速发展，并跨越包括国家安全、人权、商业关切和相关基础设施漏洞在内的许多问题领域。因此，政策制定者必须努力平衡一系列有时相互冲突的利益，这些利益争夺注意力，而且他们必须在一个几乎没有先例可借鉴的领域这样做。在探索网络安全的人的层面的问题(以及可能的补救措施)时，许多人将重点放在最终用户身上。虽然这很重要，但同样重要的是决策和公务员提供的建议的人的层面，他们共同影响政策层面对网络威胁的反应。该项目的重点是英国的政策制定者，特别是那些在应对具体危机事件或在能力建设的长期规划背景下提供短期和长期政策建议的公务员。考虑到他们目前面临的一系列独特的技术、行为和政策挑战，这一群体尤为重要。他们是一个相对较小且不同的群体，拥有不同程度的技术和行为经验；-他们的责任和影响远远超出了他们自己的组织，无法塑造国家和国际格局；最后，-缺乏研究来支持这一特定群体，要么找出他们面临的具体挑战，要么制定更有效的机制来做到这一点。这引发了几个问题：在这种背景下，英国政策制定者依赖什么证据？这些证据的质量如何？基于这些证据对威胁、风险、缓解和后果的判断有多有效？了解英国政策制定者如何选择证据，他们为何优先考虑一个来源，以及他们在识别证据中可能存在的弱点或缺陷方面有多熟练，对于解决这些问题至关重要。

The quality of a state's capacity to respond to the challenges of cyber security is rapidly coming to be recognised as an important element of global competitiveness. This project seeks to understand the challenges faced by the UK's policy making community in interpreting, evaluating and understanding evidence about cyber security. Policy makers, sometimes with little relevant expertise and often in time-critical scenarios, are asked to assess evidence from a mix of sources including official threat intelligence, academic sources, and industry threat reports. Such a diverse evidence base is then used to make judgments on threat, risk, mitigation and consequences, and offer advice shaping the national regulatory landscape, foreign and domestic security policy, and a range of public and private sector initiatives. This element of the human dimension has significant relevance for the cyber security of the UK and is the main focus of this proposal. Assessment of evidence is a particular problem for policy making in this context for three reasons: First, some of the evidence is contradictory and/or potentially carries within it particular agendas or goals that may impede upon its rigour and reliability. The 'politicisation' of cyber security evidence is increasingly problematic as states sometimes privilege threat intelligence from sources located within their sovereign borders rather than based on the quality of the research they produce; Secondly, it has proven to be extremely difficult to conclusively attribute cyber attacks and to quantify the cost of cyber insecurity. These challenges mean that evidence can only support policy makers' decisions and evaluation of cyber security risks, threats and consequences to an extent;Finally, the landscape of cyber security is developing rapidly and spans many issue areas including national security, human rights, commercial concerns, and related infrastructure vulnerabilities. Consequently, policy makers must work to balance a range of sometimes conflicting interests that compete for attention and they must do so in a field with little precedent to draw upon.When exploring the problems (and possible remedies) of the human dimension of cyber security, many focus on end users. While this is important, equally important is the human dimension of decision making and advice offered by civil servants who collectively influence policy level responses to cyber threats. This project focuses on policy makers in the UK, specifically those civil servants who provide short and long term policy advice, either in response to specific crisis incidents or in the context of longer term planning for capacity building. This cohort is of particular importance given:- the unique set of technological, behavioural and policy challenges they currently face. They are a relatively small and disparate group, possessing varying levels of technical and behavioural experience;- their responsibility and impact goes well beyond their own organisations to shape the national and international landscape; and finally, - the lack of research to support this particular community, either in identifying specific challenges they face or in developing more effective mechanisms for doing so.This leads to several questions: what evidence do UK policy makers rely upon in this context? What is the quality of that evidence? How effective are the judgements about threats, risks, mitigation and consequences based on that evidence? Understanding how UK policy makers select evidence, why they privilege one source over another, and how adept they are at recognising possible weaknesses or flaws in evidence is central to addressing these questions.