Between Hype and Understatement: Reassessing Cyber Risks as a Security Strategy

Most cyber attacks exploit existing vulnerabilities and weaknesses in information infrastructure. Because these vulnerabilities are not illegal on their own, they tend to be overlooked in the debate on cyber security. For example, a UK report on the costs of cyber crime excluded the costs of anticipating cyber crime, such as insurance and purchasing anti-virus software. The report reasoned “these are likely to be factored into the normal day-to-day expenditures for the Government, businesses, and individuals.” By under-emphasizing the threats posed by vulnerabilities, cyber terrorism is made more robust. In order to reassess cyber risk, infrastructure vulnerabilities must be acknowledged and commonly overhyped cyber crime threats must be better understood.