A Framework for Exploring Cybersecurity Policy Options
This work is licensed under a Creative Commons Attribution NonCommercial 4.0 International License. All users of the publication are permitted to copy and redistribute the material in any medium or format and transform and build upon the material for any noncommercial purpose without further permission or fees being required. The RAND Corporation is a research organization that develops solutions to public policy challenges to help make communities throughout the world safer and more secure, healthier and more prosperous. RAND is nonprofit, nonpartisan, and committed to the public interest. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors. Preface Today's cyber environment presents unlimited opportunities for innovation interaction, commerce, and creativity, but these benefits bring serious security challenges for governments, private organizations, and individual users. The cyber domain has evolved so swiftly that legal, economic, and societal mechanisms for maintaining security have struggled to keep up. Satisfactory solutions that balance the priorities of stakeholders will require building partnerships among public and private organizations, establishing mechanisms and incentives to foster routine information sharing and collective defense, and educating users about their role in thwarting increasingly sophisticated attacks. The goal of this project was to develop an initial framework for cybersecurity that considers the roles of government, industry, advo cacy organizations, and academic institutions and how these stake holders' concerns relate to each other. In support of this objective, the RAND Corporation developed and conducted a cybersecurity focused 360deg Discovery Game in Washington, D.C. and California's Silicon Valley with participants from government agencies, the technology sector, advocacy organizations, and academic institutions. The games' objective was to foster improved understanding of the positions of the various cybersecurity stakeholders and to illuminate the areas of agreement and disagreement between them. The dynamics of the game play and insights from the participants subsequently informed the framework for the cyber ecosystem. will support debate and decisionmaking on future cybersecurity policies and practices in an equitable way. This research was funded by a grant from the William and Flora Hewlett Foundation as part of its Cyber Initiative, which seeks to address a broad range of topics that affect the security, stability, and resilience of a free and open Internet and connected devices. and analysis on defense and national security topics for the U.S. and allied defense, foreign policy, homeland security, and intelligence communities and foundations and other nongovernmental organizations that support defense and national security analysis.