Perspectives on Cybersecurity Information Sharing among Multiple Stakeholders Using a Decision‐Theoretic Approach

The government, private sectors, and others users of the Internet are increasingly faced with the risk of cyber incidents. Damage to computer systems and theft of sensitive data caused by cyber attacks have the potential to result in lasting harm to entities under attack, or to society as a whole. The effects of cyber attacks are not always obvious, and detecting them is not a simple proposition. As the U.S. federal government believes that information sharing on cybersecurity issues among organizations is essential to safety, security, and resilience, the importance of trusted information exchange has been emphasized to support public and private decision making by encouraging the creation of the Information Sharing and Analysis Center (ISAC). Through a decision‐theoretic approach, this article provides new perspectives on ISAC, and the advent of the new Information Sharing and Analysis Organizations (ISAOs), which are intended to provide similar benefits to organizations that cannot fit easily into the ISAC structure. To help understand the processes of information sharing against cyber threats, this article illustrates 15 representative information sharing structures between ISAC, government, and other participating entities, and provide discussions on the strategic interactions between different stakeholders. This article also identifies the costs of information sharing and information security borne by different parties in this public‐private partnership both before and after cyber attacks, as well as the two main benefits. This article provides perspectives on the mechanism of information sharing and some detailed cost–benefit analysis.     

Security of Separated Data in Cloud Systems with Competing Attack Detection and Data Theft Processes

Empowered by virtualization technology, service requests from cloud users can be honored through creating and running virtual machines. Virtual machines established for different users may be allocated to the same physical server, making the cloud vulnerable to co‐residence attacks where a malicious attacker can steal a user's data through co‐residing their virtual machines on the same server. For protecting data against the theft, the data partition technique is applied to divide the user's data into multiple blocks with each being handled by a separate virtual machine. Moreover, early warning agents (EWAs) are deployed to possibly detect and prevent co‐residence attacks at a nascent stage. This article models and analyzes the attack success probability (complement of data security) in cloud systems subject to competing attack detection process (by EWAs) and data theft process (by co‐residence attackers). Based on the suggested probabilistic model, the optimal data partition and protection policy is determined with the objective of minimizing the user's cost subject to providing a desired level of data security. Examples are presented to illustrate effects of different model parameters (attack rate, number of cloud servers, number of data blocks, attack detection time, and data theft time distribution parameters) on the attack success probability and optimization solutions.     

Cyber Risk Management for Critical Infrastructure: A Risk Analysis Model and Three Case Studies

Managing cyber security in an organization involves allocating the protection budget across a spectrum of possible options. This requires assessing the benefits and the costs of these options. The risk analyses presented here are statistical when relevant data are available, and system‐based for high‐consequence events that have not happened yet. This article presents, first, a general probabilistic risk analysis framework for cyber security in an organization to be specified. It then describes three examples of forward‐looking analyses motivated by recent cyber attacks. The first one is the statistical analysis of an actual database, extended at the upper end of the loss distribution by a Bayesian analysis of possible, high‐consequence attack scenarios that may happen in the future. The second is a systems analysis of cyber risks for a smart, connected electric grid, showing that there is an optimal level of connectivity. The third is an analysis of sequential decisions to upgrade the software of an existing cyber security system or to adopt a new one to stay ahead of adversaries trying to find their way in. The results are distributions of losses to cyber attacks, with and without some considered countermeasures in support of risk management decisions based both on past data and anticipated incidents.     

A Comprehensive Network Security Risk Model for Process Control Networks

The risk of cyber attacks on process control networks (PCN) is receiving significant attention due to the potentially catastrophic extent to which PCN failures can damage the infrastructures and commodity flows that they support. Risk management addresses the coupled problems of (1) reducing the likelihood that cyber attacks would succeed in disrupting PCN operation and (2) reducing the severity of consequences in the event of PCN failure or manipulation. The Network Security Risk Model (NSRM) developed in this article provides a means of evaluating the efficacy of candidate risk management policies by modeling the baseline risk and assessing expectations of risk after the implementation of candidate measures. Where existing risk models fall short of providing adequate insight into the efficacy of candidate risk management policies due to shortcomings in their structure or formulation, the NSRM provides model structure and an associated modeling methodology that captures the relevant dynamics of cyber attacks on PCN for risk analysis. This article develops the NSRM in detail in the context of an illustrative example.     

中国上市公司融资结构的宏观因素分析

本文在总结国内外有关文献的基础上,从宏观和动态的角度出发,对中国上市公司融资结构的宏观经济影响因素进行了实证研究,发现资产负债率与通货膨胀水平、实际利率之间存在协整关系,说明中国上市公司的负债水平与宏观经济因素之间的关系并不是虚假回归关系,而是一种长期的均衡关系。在此基础上,笔者采用向量自回归VAR计量模型对它们之间的关系进行了动态分析,结果表明,通货膨胀率的正向冲击会给中国上市公司的负债水平带来同方向的变动,而实际利率的正向冲击则会降低其负债水平,且这些宏观经济指标的变动对中国上市公司负债水平的影响也会因行业的不同而呈现显著差异。     

A Risk Analysis Framework for Cyber Security and Critical Infrastructure Protection of the U.S. Electric Power Grid

The purpose of this article is to introduce a risk analysis framework to enhance the cyber security of and to protect the critical infrastructure of the electric power grid of the United States. Building on the fundamental questions of risk assessment and management, this framework aims to advance the current risk analysis discussions pertaining to the electric power grid. Most of the previous risk-related studies on the electric power grid focus mainly on the recovery of the network from hurricanes and other natural disasters. In contrast, a disproportionately small number of studies explicitly investigate the vulnerability of the electric power grid to cyber-attack scenarios, and how they could be prevented or mitigated. Such a limited approach leaves the United States vulnerable to foreign and domestic threats (both state-sponsored and “lone wolf”) to infiltrate a network that lacks a comprehensive security environment or coordinated government response. By conducting a review of the literature and presenting a risk-based framework, this article underscores the need for a coordinated U.S. cyber security effort toward formulating strategies and responses conducive to protecting the nation against attacks on the electric power grid.     

Empirical Analysis of the Effects of Cyber Security Incidents

We analyze the time series associated with web traffic for a representative set of online businesses that have suffered widely reported cyber security incidents. Our working hypothesis is that cyber security incidents may prompt (security conscious) online customers to opt out and conduct their business elsewhere or, at the very least, to refrain from accessing online services. For companies relying almost exclusively on online channels, this presents an important business risk. We test for structural changes in these time series that may have been caused by these cyber security incidents. Our results consistently indicate that cyber security incidents do not affect the structure of web traffic for the set of online businesses studied. We discuss various public policy considerations stemming from our analysis.     

Stochastic Counterfactual Risk Analysis for the Vulnerability Assessment of Cyber‐Physical Attacks on Electricity Distribution Infrastructure Networks

In December 2015, a cyber‐physical attack took place on the Ukrainian electricity distribution network. This is regarded as one of the first cyber‐physical attacks on electricity infrastructure to have led to a substantial power outage and is illustrative of the increasing vulnerability of Critical National Infrastructure to this type of malicious activity. Few data points, coupled with the rapid emergence of cyber phenomena, has held back the development of resilience analytics of cyber‐physical attacks, relative to many other threats. We propose to overcome data limitations by applying stochastic counterfactual risk analysis as part of a new vulnerability assessment framework. The method is developed in the context of the direct and indirect socioeconomic impacts of a Ukrainian‐style cyber‐physical attack taking place on the electricity distribution network serving London and its surrounding regions. A key finding is that if decision‐makers wish to mitigate major population disruptions, then they must invest resources more‐or‐less equally across all substations, to prevent the scaling of a cyber‐physical attack. However, there are some substations associated with higher economic value due to their support of other Critical National Infrastructures assets, which justifies the allocation of additional cyber security investment to reduce the chance of cascading failure. Further cyber‐physical vulnerability research must address the tradeoffs inherent in a system made up of multiple institutions with different strategic risk mitigation objectives and metrics of value, such as governments, infrastructure operators, and commercial consumers of infrastructure services.     

跨国公司在华独资倾向成因分析:基于股权结构战略的视角

经过20多年的对外开放 ,跨国公司在华企业得到了长足的发展。考察20多年来跨国公司在华企业的股权结构变动趋势 ,可以清晰地发现 ,其独资倾向日益明显。本文在借鉴国内外学者关于跨国公司股权结构战略的研究成果基础上 ,在东道国为新兴市场经济国家前提下 ,提出了一个跨国公司股权结构战略两阶段演进模型 ,揭示了跨国公司在华独资倾向增强的深层原因 ,是追求股权结构战略改进的预期收益。     

Resilience of Cyber Systems with Over‐ and Underregulation

Recent cyber attacks provide evidence of increased threats to our critical systems and infrastructure. A common reaction to a new threat is to harden the system by adding new rules and regulations. As federal and state governments request new procedures to follow, each of their organizations implements their own cyber defense strategies. This unintentionally increases time and effort that employees spend on training and policy implementation and decreases the time and latitude to perform critical job functions, thus raising overall levels of stress. People's performance under stress, coupled with an overabundance of information, results in even more vulnerabilities for adversaries to exploit. In this article, we embed a simple regulatory model that accounts for cybersecurity human factors and an organization's regulatory environment in a model of a corporate cyber network under attack. The resulting model demonstrates the effect of under‐ and overregulation on an organization's resilience with respect to insider threats. Currently, there is a tendency to use ad‐hoc approaches to account for human factors rather than to incorporate them into cyber resilience modeling. It is clear that using a systematic approach utilizing behavioral science, which already exists in cyber resilience assessment, would provide a more holistic view for decisionmakers.     

When Do Multinational Companies Consider Corporate Social Responsibility? A Multi‐country Study in Sub‐Saharan Africa

While African countries are becoming more and more relevant as host countries for suppliers of multinational companies little is known about corporate social responsibility (CSR) in this region. To fill this gap, the present article explores CSR considerations of foreign affiliates of multinational companies when choosing local African suppliers. The article suggests a model of three types of determinants, namely firm characteristics, exports, and intra‐trade. Analyses of a large‐scale and quite unique firm level data for more than 2,000 foreign owned firms in 19 sub‐Saharan African countries demonstrate that firms importing intermediates from their parent company abroad are more likely to implement CSR. Similarly, CSR plays a larger role for affiliates that export to developed countries. Different determinants affect environmental and social CSR activities.     

A Framework for Linking Cybersecurity Metrics to the Modeling of Macroeconomic Interdependencies

Hierarchical decision making is a multidimensional process involving management of multiple objectives (with associated metrics and tradeoffs in terms of costs, benefits, and risks), which span various levels of a large-scale system. The nation is a hierarchical system as it consists multiple classes of decisionmakers and stakeholders ranging from national policymakers to operators of specific critical infrastructure subsystems. Critical infrastructures (e.g., transportation, telecommunications, power, banking, etc.) are highly complex and interconnected. These interconnections take the form of flows of information, shared security, and physical flows of commodities, among others. In recent years, economic and infrastructure sectors have become increasingly dependent on networked information systems for efficient operations and timely delivery of products and services. In order to ensure the stability, sustainability, and operability of our critical economic and infrastructure sectors, it is imperative to understand their inherent physical and economic linkages, in addition to their cyber interdependencies. An interdependency model based on a transformation of the Leontief input-output (I-O) model can be used for modeling: (1) the steady-state economic effects triggered by a consumption shift in a given sector (or set of sectors); and (2) the resulting ripple effects to other sectors. The inoperability metric is calculated for each sector; this is achieved by converting the economic impact (typically in monetary units) into a percentage value relative to the size of the sector. Disruptive events such as terrorist attacks, natural disasters, and large-scale accidents have historically shown cascading effects on both consumption and production. Hence, a dynamic model extension is necessary to demonstrate the interplay between combined demand and supply effects. The result is a foundational framework for modeling cybersecurity scenarios for the oil and gas sector. A hypothetical case study examines a cyber attack that causes a 5-week shortfall in the crude oil supply in the Gulf Coast area.     

基于价值创造视角的互联网企业核心资源及能力研究

尽管网络经济已经成为国民经济的重要组成部分,但至今尚未形成一套适用于网络经济特征的体系化的竞争战略理论。为了弥补这一不足,本文通过对网络经济理论和战略管理理论的整合,借鉴AMIT&ZOTT提出的虚拟交易的四维价值空间理论框架,并将其推广应用到WEB2.0企业,从价值创造的角度揭示了网络企业的"3+1"核心资源和能力的构成体系。理论研究表明3种核心资源--原创内容资源、匹配数据资源、关系网络资源和1种核心能力--汇聚资源能力,对企业核心价值和竞争优势的形成具有正向的影响作用。为了检验假设,本文以北京市海淀区的248家网络企业为样本,采用结构方程模型分析方法进行分析。实证结果表明:原创内容资源、匹配数据资源和关系网络资源对核心价值和竞争优势的产生具有显著作用;而汇聚资源能力对原创内容资源、匹配数据资源和关系网络资源的形成具有显著的正效应。实证数据部分支持了本文的原始假设。     

The Determinants and Effects of Board Nomination Committees*

This article assesses the corporate governance-related antecedents of nomination committee adoption, and the impact of nomination committees’ existence and their composition on board independence and board demographic diversity. We conducted a longitudinal study of board composition amongst 210 Swiss public companies from January 2001 through December 2003, a period during which the Swiss (Stock) Exchange (SWX) introduced new corporate governance-related disclosure guidelines. We find firms with nomination committees are more likely to have a higher number of independent and foreign directors, but not more likely to have a higher number of female board members. Further, the existence of nomination committees is associated with a higher degree of nationality diversity but is not related to board educational diversity. We also find that nomination committee composition matters in the nomination of independent and foreign, but not of female directors. Our results suggest that understanding different board roles and composition require a multi-theoretical approach, and that agency theory, resource-dependence theory and group effectiveness theory help to explain different aspects of board composition and effectiveness. Finally, the article discusses the concept of diversity and appropriate ways to study diversity in a boardroom context. * The Editor acknowledges that Hans van Ees, Morten Huse, and Jonas Gabrielsson – convenors of the EURAM (European Academy of Management) Corporate Governance track in 2004 – acted as Co-Editors on this paper.     

关于外资并购国有企业若干问题的讨论——以德国博西华公司收购安徽扬子电冰箱厂为例

一、引言伴随着全球化以及中国参与国际分工程度的深入 ,大型国际跨国公司必然越来越多地选择跨国并购方式进入中国① 。与此同时 ,由于面对空前的竞争压力 ,部分国有企业也开始更多地考虑通过转让部分所有权的方式与外资进行合作。国有企业的这种将资本存量出售给跨国公司的构想 ,与前些年一些地方政府关于国企改革“一卖了之”思路 ,可以说是不谋而合。于是 ,在２０世纪９０年代中期 ,在我国掀起了外资并购国有企业的第一个高潮。抛开民族工业的保护问题不谈 ,我们认为 ,在相隔几年之后 ,回顾当时并购过程中发生的问题;考察并购后企业运…     

Combatting Identity Theft: A Proposed Ethical Policy Statement and Best Practices

The purpose of this article is to explore the law related to identity theft, to review corresponding rights, and responsibilities of stakeholders involved in identity theft and to formulate a system of best practices businesses could engage in to prevent or reduce identity theft threats. Utilizing two ethical frameworks based on deontological approaches, the authors conclude that there should be a well‐defined management scheme to prevent identity theft, which is easy to comprehend and comply with for all stakeholders. Our proposed management scheme incorporates both legal and ethical elements such that identity theft will be more difficult. Further, our proposal would also address business entities’ practices that are so careless that identity theft is made possible at all or made easier: ethical business practice can do much to reduce or eliminate identity theft.     

Aufsichtsratsverflechtungen und ihr Einfluss

This article examines the development of executive compensation of the German DAX corporations from 2001 to 2006. A higher executive compensation requires an approval of the supervisory board. Accordingly, we investigate the social network of the board of directors of these companies and use several variables describing the structure of this network as covariates of the development of the executive compensation in a panel analysis. Fixed and time effects panel estimations imply that a rising number of executives in the supervisory board of other companies results in increasing compensation. By contrast, executive compensation decreases when the supervisory board of the respective company is controlled by a growing number of executives from foreign companies.     

Fusion of Intelligence Information: A Bayesian Approach

The attack that occurred on September 11, 2001 was, in the end, the result of a failure to detect and prevent the terrorist operations that hit the United States. The U.S. government thus faces at this time the daunting tasks of first, drastically increasing its ability to obtain and interpret different types of signals of impending terrorist attacks with sufficient lead time and accuracy, and second, improving its ability to react effectively. One of the main challenges is the fusion of information, from different sources (U.S. or foreign), and of different types (electronic signals, human intelligence. etc.). Fusion thus involves two very distinct and separate issues: communications, i.e., ensuring that the different U.S. and foreign intelligence agencies communicate all relevant and accurate information in a timely fashion and, perhaps more difficult, merging the content of signals, some "sharp" and some "fuzzy," some dependent and some independent into useful information. The focus of this article is on the latter issue, and on the use of the results. In this article, I present a classic probabilistic Bayesian model sometimes used in engineering risk analysis, which can be helpful in the fusion of information because it allows computation of the posterior probability of an event given its prior probability (before the signal is observed) and the quality of the signal characterized by the probabilities of false positive and false negative. Experience suggests that the nature of these errors has been sometimes misunderstood; therefore, I discuss the validity of several possible definitions.