Information and Cyber Security

Information security is the practice of preserving confidentiality, integrity, and availability of information in all forms — digital, physical, or intellectual. Cyber security is a subset focusing on protection of digital assets and the infrastructures that store, process, and transmit them. The CIA triad forms the foundation: Confidentiality ensures information is accessible only to those authorized; Integrity safeguards accuracy and completeness of information and processing methods; Availability guarantees information and associated services are accessible when needed. Modern governance adds accountability (non-repudiation and auditability), authenticity (verifying provenance of data and commands), and resilience (capacity to absorb shocks and recover functionality swiftly).

Looking at the Problem Holistically

Security decisions are economic choices under uncertainty. Aggregate expected loss across all assets and threats is $E[L] = \sum_i \sum_j p_{ij} \cdot L_{ij}$. The objective is not to minimize $E[L]$ at all costs, but to optimize the net benefit of security spending. Risk-averse governing bodies exhibit $U(E[W]) > E[U(W)]$, implying a willingness to pay a risk premium to avoid catastrophic losses. This explains why governance boards often mandate controls that seem economically inefficient on a pure expected-value basis: they are protecting the organization's survival, not just its balance sheet.

Developing a Strategy

The seven critical steps are: (1) asset identification and valuation through business impact analysis; (2) threat and vulnerability assessment using threat intelligence and internal audits; (3) risk analysis and appetite calibration defining which risks are accepted, mitigated, transferred, or avoided; (4) compliance and standards mapping integrating legal obligations and voluntary frameworks; (5) control selection embodying defense in depth — deploying multiple overlapping layers of protection; (6) incident response and resilience planning assuming breach and preparing procedures; and (7) governance and culture embedding accountability through clear reporting structures and continuous awareness programs.

Major Cyber Risks

Advanced Persistent Threats (APTs) are highly sophisticated, targeted campaigns wherein adversaries infiltrate a network and remain undetected for extended periods. The attacker's expected payoff is $E[\Pi_A] = P_S \cdot V_D - C_A$, where $P_S$ is probability of sustained stealth, $V_D$ is value of exfiltrated data, and $C_A$ is attack cost. Organizations with high-value intellectual property or critical infrastructure present a $V_D$ that justifies high $C_A$, necessitating advanced behavioral analytics and threat hunting.

Ransomware employs asymmetric cryptography to encrypt organizational data and demand payment. Modern ransomware frequently employs double extortion, threatening to publish stolen sensitive data. The victim's decision to pay can be modeled using expected utility theory: $p \cdot U(W - R) + (1-p) \cdot U(W - R - L) > U(W - L)$. Assuming risk aversion, the organization may opt to pay even if $p$ is moderately low. Mitigation relies heavily on robust, isolated data backups which effectively reduce $L$ and make non-payment the mathematically optimal choice.

Performing Careful Risk Assessment

The Annualized Loss Expectancy is $ALE = SLE \times ARO$. The Gordon-Loeb model provides the foundational economic framework for optimizing cybersecurity investments. The expected net benefit is $ENB(z) = [v(0) - v(z)]L - z$, where $v(z)$ is the breach probability as a convex decreasing function of investment $z$. The first-order condition requires $-v'(z^*)L = 1$. A critical derivation is that the optimal investment $z^*$ should never exceed $1/e$ (approximately 37%) of the expected loss $v(0)L$.

Risks in the Supply Chain

The probability that a focal organization suffers a breach due to supply chain contagion is $P(B_i) = 1 - \prod_{j \in N_i} (1 - p_j \cdot c_{ji})$, where $N_i$ is the set of suppliers, $p_j$ is intrinsic breach probability of supplier $j$, and $c_{ji}$ is the conditional probability that a breach at $j$ propagates to $i$. Governance frameworks must mandate stringent security baselines for all nodes, operationalized through international standards such as ISO 28001 and ISO 27001.

Controls for Layered Protection

The defense-in-depth paradigm employs the PPT triad. The security production function is Cobb-Douglas: $S = A \cdot H^{\alpha} \cdot R^{\beta} \cdot T^{\gamma}$, where $H$ is human capital investment, $R$ is process maturity, and $T$ is technological controls. The tangency condition for optimal input allocation requires $\frac{\alpha / H}{w_H} = \frac{\beta / R}{w_R} = \frac{\gamma / T}{w_T}$ — marginal security product per dollar must be equalized across all three domains.

Efficiency vs. Security

Every security control imposes friction on legitimate workflows. The organization maximizes $\max_{s} V(s) - C(s) - L \cdot P(\text{breach} \mid s)$, where $V(s)$ is the value of legitimate operations decreasing in $s$ due to friction. The first-order condition equates marginal cost of additional friction to marginal reduction in expected breach loss. Perfect security is never optimal because the last increments of protection impose prohibitive efficiency costs.

Managing Assets That You Don't Control

Shadow IT emerges as the rational response of employees to friction imposed by sanctioned systems. The employee chooses shadow IT when $\Delta B - \Delta f > \pi \cdot \delta$, where $\Delta B$ is the differential convenience benefit, $\Delta f$ is the differential friction cost, $\pi$ is detection probability, and $\delta$ is the expected sanction. Three governance levers: reduce $\Delta B$ by procuring sanctioned tools matching shadow alternatives; increase $\Delta f$ through network segmentation; increase $\pi \cdot \delta$ through monitoring and enforcement. The first lever — improving sanctioned alternatives — is often the most cost-effective.