Strategic decision making in cyber security: Lessons learned

The threats to the international community currently emerging in cyber space represent great challenges to security and it is of utmost importance to be ready to respond. This calls for a stronger and more resilient community, which will be well prepared to face these new challenges. The paper considers the preparation of strategic leaders to deal with cyber space crisis management processes in the form of a European Defence Agency (EDA) tabletop exercise. This is developed from the EU approach to cyber crisis management and the efforts undertaken by the European Defence Agency and European Cyber Security Initiative (ECSI), as well as a customised scenario based upon the Austrian Cyber Security Strategy. The paper gives a brief history of the development of the cyber crisis management exercise and explains its purpose, which is to devise an exercise curriculum for a coherent conceptual toolkit that could be used in assessing current decision-making frameworks. It describes how to run such a decision-making exercise, building on concepts and methodologies used to manage a cyber security crisis. It gives an overview of typical situations, threats, nature and likelihood, possible impact and the assessment of typical cyber situations, illustrated with scenarios, frameworks and doctrines. It further deals with response management, options, decisions (outcome, execution) and success control. Last but not least, it describes lessons identified and learned, offers a short evaluation of the exercise and the process of decision making and draws some conclusions.