Individual Behavior as a Defense in the “War on Cyberterror”: A System Dynamics Approach

ABSTRACT

The problem of cyberterrorism, despite its contested nature, is an important area of research. Scholars agree that the most dangerous targets for such attacks are critical infrastructure and organizations that are vital to society due to their interconnectedness to the modern world and their increasing reliance on the cyber domain for their operations. Thus, their security and protection against cyberterrorism is of elevated importance. Given the lack of documented cases of cyberterrorism, the purpose of this article is to simulate the threat of a terrorist act on a critical infrastructure, using a computer virus and to investigate how the individual behavior of employees affects security.

 :

•  

Notes

1. Stephen M. Marshall, Offensive Cyber Capability: Can it Reduce Cyberterrorism (Army Command and General Staff College, Fort Leavenworth, KS: School of Advanced Military Studies, 2010).

2. Anna-Maira Talihärm, “Cyberterrorism: in Theory or in Practice?,” Defence Against Terrorism Review 3(2) (2010), pp. 59–74.

3. Michael Kenney, “Cyber-Terrorism in a Post-Stuxnet World,” Orbis 59(1) (2015), pp. 111–128.

4. Maura Conway, “The Media and Cyberterrorism: A Study in the Construction of ‘Reality,’” First International Conference on the Information Revolution and The Changing Face of International Relations and Security (Lucerne, Switzerland, 2008); Tina Freiburger and Jeffrey S. Crane, “A Systematic Examination of Terrorist Use of the Internet,” International Journal of Cyber Criminology 2(1) (2008), pp. 309–319; Talihärm, “Cyberterrorism: In Theory or in Practice?”

5. Irving Lachow and Courtney Richardson, Terrorist Use of the Internet: The Real Story (Washington, DC: National Defense University, 2007).

6. Marshall, Offensive Cyber Capability.

7. Conway, “The Media and Cyberterrorism: A Study in the Construction of ‘Reality.’”

8. Marshall, Offensive Cyber Capability.

9. Jian Hua and Sanjay Bapna, “The Economic Impact of Cyber Terrorism,” The Journal of Strategic Information Systems 22(2) (2013), pp. 175–186.

10. Dorothy Denning, Cyberterrorism. Testimony before the Special Oversight Panel on Terrorism Committee on Armed Services US House of Representatives (Washington DC, 2000).

11. John Rollins and Clay Wilson, Terrorist Capabilities for Cyberattack: Overview and Policy Issues (Washington, DC: CRS Report for Congress, 2007); Lachlan MacKinnon, Liz Bacon, Diane Gan, Giorgios Loukas, David Chadwick, and Dimitrios Frangiskatos, “Cyber Security Countermeasures to Combat Cyber Terrorism,” in Babak Akhgar and Simeon Yates, eds., Strategic Intelligence Management (pp. 234–257) (London: Butterworth-Heinemann, 2013).

12. Cited in Steven M. Furnell and Matthew J. Warren, “Computer Hacking and Cyber Terrorism: The Real Threats in the New Millenium?,” Computer & Security 18(1) (1999), pp. 28–34.

13. Kieran Hardy and George Williams, “What is ‘Cyberterrorism’? Computer and Internet Technology in Legal Definitions of Terrorism,” in Tom Chen, Lee Jarvis, and Stuart Macdonald, eds., Cyberterrorism. Understanding, Assessment and Response (New York: Springer, 2014), 1–23.

14. Kenney, “Cyber-Terrorism in a Post-Stuxnet World.”

15. Raymond C. Parks and David P. Duggan, “Principles of Cyberwarfare,” IEEE Security and Privacy 9(5) (2011), pp. 30–35.

16. Rabiah Ahmad, Zahri Yunos, and Shahrin Sahib, “Understanding Cyber Terrorism: The Grounded Theory Method Applied,” IEEE International Conference on Cyber Security, Cyber Warfare and Digital Forensic (2012), pp. 323–328; Hua and Bapna, “The Economic Impact of Cyber Terrorism”; Mackinnon et al., “Cyber Security Countermeasures to Combat Cyber Terrorism.”

17. Kenney, “Cyber-Terrorism in a Post-Stuxnet World.”

18. Lachow and Richardson, Terrorist Use of the Internet.

19. Stephen Hinde, “Cyber-Terrorism in Context,” Computers & Security 22(3) (2003), pp. 188–192; Hua and Bapna, “The Economic Impact of Cyber Terrorism”; Jian Hua and Sanjay Bapna, “How Can We Deter Cyber Terrorism?,” Information Security Journal: A Global Perspective 21(2) (2012), pp. 102–114; Mackinnon et al., “Cyber Security Countermeasures to Combat Cyber Terrorism.”

20. Conway, “The Media and Cyberterrorism; Marshall, Offensive Cyber Capability; Hua and Bapna, “The Economic Impact of Cyber Terrorism”; Talihärm, “Cyberterrorism: In Theory or in Practice?”

21. Talihärm, “Cyberterrorism: In Theory or in Practice?”

22. Gabriel Weimann, WWW.TERROR.NET: How Modern Terrorists Use the Internet (Washington DC: United States Institute of Peace Special Report, 2004).

23. Yariv Tsfati and Gabriel Weimann, “www.terrorism.com: Terror on the Internet,” Studies in Conflict and Terrorism 25(5) (2002), pp. 317–332; Timothy L. Thomas, Al Qaeda and the Internet: The Danger of “CyberPlanning” (Fort Leavenworth, KS: Foreign Military Studies Office, 2003); Todd M. Hinnen, “The Cyber-Front in the War of Terrorism: Curbing Terrorist Use of the Internet,” The Columbia Science and Technology Law Review 5(5) (2004), pp. 1–42; Lachow and Richardson, Terrorist Use of the Internet; Mehmut Nesip Ogun, “Terrorist Use of the Internet: Possible Suggestions to Prevent the Usage for Terrorist Purposes,” Journal of Applied Security Research 7(2) (2012), pp. 203–217; Lee Jarvis, Lella Nouri, and Andrew Whiting, “Understanding, Locating and Constructing Cyberterrorism,” in Chen et al., Cyberterrorism. Understanding, Assessment and Responses, pp. 25–41.

24. Jessica Stern and J. M. Berger, ISIS: The State of Terror (London: HarperCollins, 2015).

25. Conway, “The Media and Cyberterrorism: A Study in the Construction of ‘Reality.’”

26. Hua and Bapna, “How Can We Deter Cyber Terrorism?”

27. Oliver Wheaton, “All-Out War between Anonymous and ISIS,” Metro, 19 November 2015. Available at http://metro.co.uk/2015/11/19/all-out-war-between-anonymous-and-isis-5511747/ (accessed 19 November 2015).

28. Kenney, “Cyber-Terrorism in a Post-Stuxnet World.”

29. Johannes M Bauer and Michel Van Eeten, “Cybersecurity: Stakeholder Incentives, Externalities, and Policy Options,” Telecommunications Policy 33(10) (2003), pp. 706–719.

30. A. K. Misra, Maitri Verma, and Anupama Sharma, “Capturing the Interplay between Malware and Anti-Malware in a Computer Network,” Applied Mathematics and Computation 229 (2014), pp. 340–349.

31. Xie Han and Qiulin Tan, “Dynamical Behavior of Computer Virus on Internet,” Applied Mathematics and Computation 217(6) (2010), pp. 2520–2526.

32. Jose R. C. Piqueira, Adolfo A. de Vasconcelos, Carlos E. C. J. Gabriel, and Vanessa O. Araujo, “Dynamic Models for Computer Viruses,” Computers & Security 27(7) (2008), pp. 355–359; Bimal Kumar Mishra and Samil Kumar Pandey, “Dynamic Model of Worms with Vertical Transmission in Computer Network,” Applied Mathematics and Computation 217(21) (2011), pp. 8438–8446: Lu-Xing Yang, Xiaofan Yang, Qingyi Zhu, and Luosheng Wen, “A Computer Virus Model with Graded Cure Rates,” Nonlinear Analysis: Real World Applications 14(1) (2013), pp. 414–422; Yoshiaki Muroya, Yoichi Enatsu, and Huaixing Li, “Global Stability of a Delayed SIRS Computer Virus Propagation Model,” International Journal of Computer Mathematics 91(3) (2013), pp. 347–367; Lu-xing Yang and Xiaofan Yang, “A New Epidemic Model of Computer Viruses,” Communications in Nonlinear Science and Numerical Simulation 19(6) (2014), pp. 1935–1944.

33. Misra et al., “Capturing the Interplay between Malware and Anti-Malware in a Computer Network.”

34. Chenquan Gan, Xiaofan Yang, Wanping Liu, and Qingyi Zhu, “A Propagation Model of Computer Virus with Nonlinear Vaccination Probability,” Communications in Nonlinear Science and Numerical Simulation 19(1) (2014), pp. 92–100; Yang and Yang, “A New Epidemic Model of Computer Viruses.”

35. Sandip Roy, Mengran Xue, and Sajal K Das, “Security and Discoverability of Spread Dynamics in Cyber-Physical Networks,” Parallel and Distributed Systems 23(9) (2012), pp. 1694–1707.

36. Jun Li and Paul Knickerbocker, “Functional Similarities between Computer Worms and Biological Pathogens,” Computers & Security 26(4) (2007), pp. 338–347; Han and Tan, “Dynamical Behavior of Computer Virus on Internet.”

37. Lu-Xing Yang and Xiaofan Yang, “The Spread of Computer Viruses under the Influence of Removable Storage Devices,” Applied Mathematics and Computation 219(8) (2012), pp. 3914–3922.

38. Giuseppe Serazzi and Stefano Zanero, “Computer Virus Propagation Models,” Performance Tools and Applications to Networked Systems (2004), pp. 26–50.

39. Michael Kremer, Integrating Behavioral Choice into Epidemiological Models of the AIDS Epidemic (Cambridge, MA: National Bureau of Economic Research, 1996); Joshua M. Epstein, Jon Parker, Derek Cummings, and Ross A. Hammond, Coupled Contagion Dynamics of Fear and Disease: Mathematical and Computational Explorations (Sante Fe, NM: Center on Social and Economic Dynamics, 2007); Erik Pruyt, Willem L. Auping, and Jan H. Kwakkel, “Ebola in West Africa: Model‐Based Exploration of Social Psychological Effects and Interventions,” Systems Research and Behavioral Science 32(1) (2015), pp. 2–14.

40. Yang et al., “A Computer Virus Model with Graded Cure Rates.”

41. Yang and Yang, “A New Epidemic Model of Computer Viruses.”

42. Jay Wright Forrester, Industrial Dynamics (Cambridge, MA: MIT Press, 1961); John Sterman, Business Dynamics: Systems Thinking and Modeling for a Complex World (Boston: Irwin/McGraw-Hill, 2000).

43. Pruyt et al., “Ebola in West Africa.”

44. Donella Meadows, “The Unavoidable A Priori,” in Jørgen Randers, ed., Elements of the System Dynamics Method (pp. 23–57) (Cambridge, MA: MIT Press, 1980).

45. James M. Lyneis, “System Dynamics for Market Forecasting and Structural Analysis,” System Dynamics Review 16(1) (2000), pp. 3–25.

46 Markus Schwaninger and José Pérez Rios, “System Dynamics and Cybernetics: A Synergetic Pair,” System Dynamics Review 24(2) (2008), pp. 145–174.

47. Andrei Borshchev and Alexi Filippov, “From System Dynamics and Discrete Event to Practical Agent Based Modeling: Reasons, Techniques, Tools,” in Proceedings of the 22nd International Conference of the System Dynamics Society (Oxford, England, 25–29 July 2004), pp. 87–94.

48. Sergio P. Santos, Valerie Belton, and Susan Howick, “Adding Value to Performance Measurement by Using System Dynamics and Multicriteria Analysis,” International Journal of Operations & Production Management 22(11) (2002), pp. 1246–1272.

49. P. C. Gardiner and A. Ford, “Which Policy Run is Best and Who Says So?,” System Dynamics: TIMS Studies in the Management Sciences 14 (1980), pp. 241–257.

50. Stefano Armenia, Yannis Charalabidis, Diego Falsini, Fenareti Lampathaki, David Osimo, and Katarzyna Szkuta “Future Research Directions in Governance and Policy Making under the UE Prism of ICT for Governance and Policy Modelling,” in the Proceedings of the 29th International Conference of the System Dynamics Society (Washington, DC, 24–28 July 2011); Stefano Armenia, Georgios Tsaples, and Camillo Carlini, “Interactive Learning Environmnents for Crisis Management through a System Dynamics approach,” in Proceedings of the 15th European Academy of Management (EURAM) (Warsaw, Poland, 17–20 June 2015).

51. Jack Homer, James Ritchie-Dunham, Hal Rabbino, Luz Maria Puente, James Jorgensen, and Kate Hendricks, “Towards a Dynamic Theory of Antibiotic Resistance,” System Dynamics Review 16(4) (2000), pp. 287–319; Kimberly M. Thompson and Radboud J. Duintjer Tebbens, “Eradication versus Control of Poliomyelitis: An Economic Analysis,” The Lancet 369(9570) (2007), pp. 1363–1371; Erik Pruyt and Caner Hamarat, “The influenza A (H1N1) v Pandemic: An Exploratory System Dynamics Approach,” in Proceedings of the 28th International Conference of the System Dynamics Society (Seoul, Korea, 25–29 July 2010).

52. Dana Polatin-Reuben, Richard Craig, Theodoros Spyridopoulos, and Theo Tryfonas, “A System Dynamics Model of Cyber-Conflict,” IEEE International Conference on Systems, Man, and Cybernetics (Manchester, England, 13–16 October 2013), pp. 303–308; Stefano Armenia, Alessandro Cardazzone, and Camillo Carlini, “Understanding Security Policies in the Cyber Warfare Domain through System Dynamics,” in Proceedings of 4th International Defense and Homeland Security SImulation Workshop (Bordeaux, France, 10–12 September 2014).

53. For more details see http://www.iseesystems.com/Softwares/Business/ithinkSoftware.aspx.