Insights & Research

Papers & Reports

Information Sharing - U.S. Legal and Regulatory Guidance

Information sharing about cybersecurity threats and vulnerabilities produces enormous benefits, however, within the U.S. reaping the benefits of can be challenging. This paper aims to provide some guidance on how to move forward and minimize risk.

Shoring Up Subsea Cable Security

A Policy Roadmap to Enhance Resilience in Europe

Developing a National Cybersecurity Strategy

Developing a national cybersecurity strategy is a critical investment a government can make to secure its future. This paper outlines the components and offers a framework with the tools to design, implement, and improve their strategies.

Meeting the Homeland C-UAS Threat

A recent tabletop exercise examined the impact of drone attacks on a university hockey game, electric grid, and nearby air base and recommended key findings to deter and prevent these types of attacks.

Europe’s DMA: A Cybercriminal's Paradise?

Mobile devices serve many purposes and a single vulnerability can wreak havoc. This paper focuses on the DMA provisions around mobile OS's, identifies the key risks, and makes makes recommendations to void weakening the mobile ecosystem.

Shoring Up Subsea Security: A Comprehensive Action Plan to Promote Submarine Cable Resiliency, Security, & Governance

Submarine cables are the essential infrastructure enabling the global economy. This paper recommends enhancing the resilience of the ecosystem through greater route diversity and redundancy, rapid repair capacity, and secure supply chain.

Report - Addressing International IT Concentration Risk: A Five-Eyes Informed Exercise

The Center convened the latest in a series of tabletop exercises exploring IT concentration risk within a broader international context with Five Eyes officials and industry reps.

Examining Critical Infrastructure Cybersecurity and Resilience: A CCPL Tabletop Exercise After Action Report

The Center conducted a tabletop exercise exploring the ability of government and private sector to address disruption from a nation state with sophisticated cyber capabilities may cause to critical infrastructure if given extensive freedom of action.

CCPL Report: Ensuring the Longevity of the CVE Program

Because the future of the CVE program faces some uncertainty it’s time to start a dialogue about the future of the program. This report is designed to provide that starting point.

To Hack Back, or Not Hack Back? That is the Question … or is it?

The U.S. is facing a new era of digital conflict where cyberattacks are persistent campaigns targeting critical infrastructure. In response, calls to embrace offensive cyber have grown as questions and challenges around these capabilities are raised.