EFFECTIVENESS OF NATIONAL CYBER POLICY TO STRENGTHEN THE SECURITY AND RESILIENCE OF CRITICAL INFRASTRUCTURE AGAINST CYBER ATTACKS

Presidential Policy Directive (PPD) 21, Critical Infrastructure Security and Resilience, directs a whole-of-government approach to strengthening the security and resilience of critical infrastructure against physical and cyber threats. Per policy, critical infrastructure is categorized into 16 sectors. Security and resiliency efforts against cyber threats are constrained by this sector-based approach. This thesis assesses the sector-based approach by the following criteria: expertise or a notable advantage of the sector-specific agency; promotion of cybersecurity measures by the critical infrastructure community partnership structure; and legislation, policy, or sector-specific characteristics that enhance security and resilience of the sector. These assessments gauged the adequacy of organizational structures that lead and support critical infrastructure cybersecurity. Exemplar cyber attacks against critical infrastructure and response actions are described in order to demonstrate strengths and limitations of the sector-based approach. This examination reveals that the U.S. approach to critical infrastructure is well conceived and executed in general. A number of significant vulnerabilities do remain in some sectors, however, as a result of incomplete or insufficient implementation.

Department dc:contributor.department

Information Sciences (IS)

Grantor dc:publisher

Monterey, CA; Naval Postgraduate School

Year dc:date.issued

2020

Author dc:creator

• Simon, Ian G.

Advisor dc:contributor.advisor

• Davis, Duane T.

Statement dc:rights

• This publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States

Handle dc:identifier.uri

https://hdl.handle.net/10945/66140

OAI identifier oai:identifier

oai:calhoun.nps.edu:10945/66140