Table 7 Emergent network risk dimensions and associated factors (Study 2)

INFORMATION DIMENSION: Features related to the information stored on the network, the adversaries who want that information, and the consequences of the information being compromised. [Vignette #1: Hospital network]

Recordkeeping could convert back to paper.

Hospital is in a metropolitan area.

Various adversarial organizations have growing concerns over the lack of medical record privacy because of the legislation.

The hacker’s intent was to motivate another reformation of the national health care system.

All patient records are digitized.

It (the network) involves a large hospital.

The type of data the hospital handles

Release of patient care information violates HIPAA regulations.

Hackers in the past few weeks have been attacking various medical centers nationwide.

These attacks in the past few weeks have leaked private patient care information on the internet.

These adversarial organizations are persistent and academically capable of executing an attack.

A prolonged outage of digital recordkeeping could cause significant damage to the hospital’s ability to serve its patients.

Release of patient care information damages hospital’s reputation.

Release of patient care information puts the hospital in legal liability.

INFRASTRUCTURE DIMENSION: Features related to the infrastructure of the network and the compliance of the network with established protocols. [Vignette #1: Hospital network]

Machines are not connected to both the private network and the internet.

The hospital recently installed additional emergency electrical generators.

The personnel manning facilities are competent.

The IT department is adequately staffed.

A disaster recovery plan has been implemented.

Results of the audit meet or exceed best practices for network configuration and maintenance.

The recovery effort from a natural disaster is expected to be rapid.

All digitized records are stored and processed on a private network.

IT had a yearly audit due to HIPAA requirements.

Database is Linux based for large-scale processing and storage.

Records are transferred from one hospital to another manually.

These adversarial organizations are not financially well funded.

The recent legislation on the reformation of the national health care system

Network is connected to programmable logic controllers (PLCs) for the medical equipment to receive test results and to manage and operate the machines. A PLC is a digital computer used for automating electromechanical processes.

The back-end servers are unique and housed in a single data center on the hospital premises.

PERSONNEL SKILL DIMENSION: Features related to the skill and training of network personnel. [Vignette #2: Military network]

The network is a self-contained, segregated, and air-gapped network.

The IT staff man the network 24/7.

The network is in full compliance with the DoD.

The IT staff are fully trained.

An audit was recently passed.

The IT staff are well trained at various military schools.

The military installation has a mature emergency operation plan (EOP) and continuity of operations plan (COOP) that comply with the Federal Emergency Management Agency (FEMA) recommendations.

Full recovery is expected to occur quickly.

The systems running on the network use proprietary military operating systems.

The network is within a small geographical region near a war zone.

ADVERSARY SKILL DIMENSION: Features related to the skill, resources, and motivation of the adversary. [Vignette #2: Military network]

The network has various UNIX systems.

The network is heterogeneous with Windows, UNIX, and proprietary military operating systems.

The network has Windows systems.

The primary adversary is a nation state.

The adversary is deeply interested in U.S. troop positioning.

The primary adversary is well funded.

The adversary is highly motivated.

The adversary was likely trained by the U.S. government in the past two years.

Malicious activity has been noted on the network in the past six months since wartime operations intensified in this region.

The primary adversary has excellent offensive cyber skills equal to or better than 90 existing nation states.