Cyber Defense as a Complex Adaptive System: A model-based approach to strategic policy design

TL;DR

This paper proposes a complexity science and agent-based modeling approach to improve cybersecurity policy design by understanding socio-technical dynamics and emergent organizational needs.

Contribution

It introduces a novel model using complexity science and agent-based simulation to analyze strategic cybersecurity policies and their organizational impacts.

Findings

Agent-based model reveals complex interactions affecting cybersecurity outcomes

Policy decisions have emergent effects on organizational security posture

Framework supports evidence-based cybersecurity strategy development

Abstract

In a world of ever-increasing systems interdependence, effective cybersecurity policy design seems to be one of the most critically understudied elements of our national security strategy. Enterprise cyber technologies are often implemented without much regard to the interactions that occur between humans and the new technology. Furthermore, the interactions that occur between individuals can often have an impact on the newly employed technology as well. Without a rigorous, evidence-based approach to ground an employment strategy and elucidate the emergent organizational needs that will come with the fielding of new cyber capabilities, one is left to speculate on the impact that novel technologies will have on the aggregate functioning of the enterprise. In this paper, we will explore a scenario in which a hypothetical government agency applies a complexity science perspective, supported by agent-based modeling, to more fully understand the impacts of strategic policy decisions. We present a model to explore the socio-technical dynamics of these systems, discuss lessons using this platform, and suggest further research and development.