Measuring the Utility of a Cyber Incident Mission Impact Assessment (CIMIA) Process for Mission Assurance

摘要

Information is a critical asset on which virtually all modern organizations depend upon to meet their operational mission objectives. Military organizations, in particular, have embedded Information and Communications Technologies (ICT) into their core mission processes as a means to increase their operational efficiency, exploit automation, improve decision quality, and shorten the kill chain. However, the extreme dependence upon ICT results in an environment where a cyber incident can result in severe mission degradation, or possibly failure, with catastrophic consequences to life, limb, and property. These consequences can be minimized by maintaining real-time situational awareness of mission critical resources so appropriate contingency actions can be taken in a timely manner following an incident in order to assure mission success. In this thesis, the design and analysis of an experiment is presented for the purpose of measuring the utility of a Cyber Incident Mission Impact Assessment (CIMIA) notification process, whose goal is to improve the timeliness and relevance of incident notification. In the experiment, subjects are placed into a model environment where they conduct operational tasks in the presence and absence of enhanced CIMIA notifications. The results of the experiment reveal that implementing a CIMIA notification process significantly reduced the response time required for subjects to recognize and take proper contingency actions to assure their organizational mission. The research confirms that timely and relevant notification following a cyber incident is an essential element of mission assurance.