Distributed and centralized cyber resilience
Resilience is, according to a US Presidential Policy Directive issued in 2011, ‘the ability to adapt to changing conditions and withstand and rapidly recover from disruption’.5 The most precise statement of resilience in GCC national cybersecurity strategies follows this definition closely, stating that resilience is ‘the ability to prepare for, adapt to, withstand, and rapidly recover from disruptions resulting from deliberate attacks, accidents, or naturally occurring threats or incidents’.6 Resilience and security have subtly different objectives: security seeks to avoid and respond to failure and disruption, while resilience aims to sustain holistic function and increase capacity for its continuation in any eventuality.7 There are nonetheless many overlaps between cybersecurity and cyber resilience, both conceptually and in terms of relevant practices. This paper draws on many indicators of cybersecurity and cyber risk. The concept of resilience can be applied at many levels, from individual organisms to whole societies and ecosystems.8
Security seeks to avoid and respond to failure and disruption, while resilience aims to sustain holistic function and increase capacity for its continuation in any eventuality
Resilience is an important property of information and communications systems. In the early twentieth century, the field of cybernetics sought to create resilient systems that would self-adjust based on environmental feedback.9 A more direct lineage of resilience comes from packet-switching, proposed in the 1960s as a way for US military communications to be more resilient in the event of a Soviet nuclear strike, and then incorporated into the Internet Protocol (IP) as the standard for the US Department of Defence’s ARPANET in the 1970s.10 Two of the three core concepts of information security – integrity and availability – are directly related to resilience, ensuring that information flows remain trusted and continuous despite attacks.11 Cyber resilience, then, is at base the resilience of digital information systems.12
Cyber resilience, however, does not apply to information systems only in the narrow terms above, describing digital networks of hardware and software. As Schneier and Farrell argue in their analysis of US election interference, whole states can be modelled as information systems, drawing on a wider scholarship of globalization and information flows.13 Cyber resilience, in this view, also includes the broader ability of states to withstand strategic influence operations aimed at disrupting or manipulating information flows between citizens, politicians and other domestic actors. A comprehensive approach to cyber resilience includes both resilience to ‘traditional’ cyberattacks and to strategic attempts to influence the information environment of a state.14
Like security, resilience is relative to threat.15 A system that is resilient to one set of threats may not be resilient to others, and, more problematically, steps taken to increase resilience in some ways may decrease resilience in others.16 It is therefore necessary to consider the resilience of different types of systems. Specifically, the paper identifies centralized systems, in which a single node entirely controls the processes of other nodes, and distributed systems, in which tasks are completed asynchronously, independently and concurrently.17 This is a spectrum rather than a binary division, with decentralization a mid-point between the two.18
Distributed systems are widely thought to be more resilient than centralized systems, largely because they do not have a single point of failure.19 However, for some threats and tasks, distribution can be less resilient than centralization.20 In particular, strategic threats requiring coordinated responses as a whole may be better countered in a centralized system, while lower-level threats impacting part of a system would be better countered in a distributed system.21 For example, the definition of cyberthreats to the US has expanded following Russian influence operations in the 2016 US presidential election, and disparate private-sector responses have been replaced by calls for a ‘whole-of-nation’ response: in short, moving from a distributed to a centralized approach to cyber resilience.22
This shift in the US demonstrates that the distinction between distributed and centralized systems is not exactly equivalent to that between democratic and authoritarian political systems.23 Recent scholarship on information operations in the US focuses on ‘democracy’s dilemma’: the idea that improving democratic resilience to foreign influence operations could damage the practice of democracy itself.24 This dilemma is drawn from parallels to Samuel Huntingdon’s ‘King’s Dilemma’, in which autocratic leaders face a choice between stability and modernization. The King’s Dilemma has been applied often to the autocratic monarchal systems of the GCC states.25 In contrast, the distributed/centralized distinction allows us to move away from distinctive democratic/autocratic dilemmas towards a cyber resilience framework that can be applied across states, while avoiding what Schneier and Farrell call an ‘easy equivalence’ between democracies and autocracies.26
5 Obama, B. (2011), Presidential Policy Directive PPD/8 Subject: National Preparedness, The White House, 30 March 2011, p. 6. https://www.dhs.gov/presidential-policy-directive-8-national-preparedness (accessed 21 Feb. 2020).
6 ictQatar (2014), Qatar National Cyber Security Strategy, p. 24.
7 For a deeper philosophical derivation and discussion, see Zebrowski, C. (2013), ‘The Nature of Resilience’, Resilience 1(3): pp. 159–73, https://doi.org/10.1080/21693293.2013.804672; Brassett, J., Croft, S. and Vaughan-Williams, N. (2011), ‘Special Issue: Security and the Politics of Resilience’, Politics 33(4); Dunn Cavelty, M., Kaufmann, M. and Kristensen, K. (2015), ‘Special Issue: Resilience and (in)security): practices, subjects, temporalities’, Security Dialogue, 46(1).
8 For a critique of the relationship between resilience at a societal and individual level see Evans, B. and Reid, J. (2014), Resilient Life: The Art of Living Dangerously, Cambridge: Polity.
9 Wiener, W. (1965), Cybernetics, or the Control and Communication in the Animal and the Machine, Cambridge, Mass: The MIT Press.
10 Baran, P. (1964), ‘Memorandum RM-3420-PR On Distributed Communications: 1. Introduction to Distributed Communications Networks’, United States Air Force Project Rand, https://www.rand.org/content/dam/rand/pubs/research_memoranda/2006/RM3420.pdf (accessed 21 Feb. 2020); Leiner, B., Cerf, V., Clark, D., Kahn, R. and Kleinrock, L. (1997), ‘A Brief History of the Internet’, ACM SIGCOMM Computer Communication Review, 39(5): pp. 22–31.
11 Although confidentiality often occupies prime position in cybersecurity discussions, cyberattacks targeting integrity and availability, such as denial of service and ransomware, have recently been at the forefront of international policy discussions (e.g. Mirai, Wannacry).
12 See Herrington, L. and Aldrich, R. (2013), ‘The Future of Cyber-Resilience in an Age of Global Complexity’, Politics 33(4): pp. 299–310, https://doi.org/10.1111/1467-9256.12035. Their discussion highlights that distributed approaches to cyber resilience are not necessarily planned, with extensive ‘systems diversity’ in the UK due to the presence of legacy infrastructure.
13 Schneier, B. and Farrell, H. (2018), Common-Knowledge Attacks on Democracy, Berkman Klein Center for Internet and Society: Harvard University. We recognize that the information environment of a state, especially in the digital era, is not easily distinguishable from that of a region or the whole world. However, the ‘territorializing practices’ of states in applying national geographic borders to cyberspace mean that this is increasingly becoming a viable way of thinking about information flows. In other words, ‘of’ is not identical to the conceptually problematic ‘within’ a state. See Lambach, D. (2019), ‘The Territorialization of Cyberspace’, International Studies Review, viz022, https://doi.org/10.1093/isr/viz022.
14 A good example of a narrower approach, focusing only on network security, is Bissell, K., Lasalle, R., Dool, F. van den and Kennedy-White, J. (2018), Gaining Ground on the Attacker: 2018 State of Cyber Resilience, Accenture Security.
15 Cavelty, M. D., Kaufmann, M. and Kristensen, K. S. (2015), ‘Resilience and (in)Security: Practices, Subjects, Temporalities’, Security Dialogue, 46(1): pp. 3–14, https://doi.org/10.1177/0967010614559637.
16 Ross, R., McEvilley, M. and Oren, J. (2018), Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems, National Institute of Standards and Technology, https://doi.org/10.6028/NIST.SP.800-160v1.
17 This is an extreme simplification of a large and complex field. For an introduction, see Maier, M. W. and Rechtin, E. (2009), The Art of Systems Architecting, 3rd edition, Boca Raton: CRC Press.
18 Hierarchies are possible even in distributed systems, although they depend on group nominations in both social and technical versions.
19 Matni, N., Leong, Y., Wang, Y., You, S., Horowitz., M. and Doyle, J. (2014), ‘Resilience in Large Scale Distributed Systems’, Procedia Computer Science, Conference on Systems Engineering Research, 28, pp. 285–93, https://doi.org/10.1016/j.procs.2014.03.036.
20 Goldman, H. (2010), Building Secure, Resilient Architectures for Cyber Mission Assurance, The MITRE Corporation.
21 It is worth noting that cyber and other threats can also be characterized as distributed or centralized: for more details, see US Department of Homeland Security and US Department of Commerce (2018), A Report to the President on Enhancing the Resilience of the Internet and Communications Ecosystem Against Botnets and Other Automated, Distributed Threats, 22 May 2018, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=925900 (accessed 21 Feb. 2020).
22 Rosenbach, E. and Mansted, K. (2018), Can Democracy Survive in the Information Age?, Belfer Center for Science and International Affairs, Harvard Kennedy School. We use ‘approach’ as a looser term than ‘system’ to refer to strategies, structures and processes in this paper.
23 Although the terminology of systems architecture, with ‘master-slave’ and ‘peer-to-peer’ relationships describing centralized and distributed systems, respectively, deliberately reflects certain social relationships.
24 Farrell, H. and Schneier, B. (2019), ‘Democracy’s Dilemma’, Boston Review, https://perma.cc/JW5F-EEFF.
25 For example, Kostiner, J. (2000) (ed.), Middle East Monarchies: The Challenge of Modernity, Boulder, Colo: Lynne Rienner Publishers.
26 Farrell, H. and Schneier, B. (2019), ‘Democracy’s Dilemma’. Our analysis highlights what Ennis terms the ‘entrepreneurial power’ of ‘flexible autocracy’ in the Gulf states. Ennis, C. (2018), ‘Reading Entrepreneurial Power in Small Gulf States: Qatar and the UAE’, International Journal, 73(4): pp. 573–95, https://doi.org/10.1177/0020702018809980.