Cybersecurity: The Three-headed Janus

Abstract

Multiple entities define the stage: Ayn, an accomplished CIO; James, an idealistic CEO; Kira, an unscrupulous hacker; Randcom, a rail company; and Zuidia, a country reinventing itself. These entities intersect in a tense cybersecurity gameplay. A cyber-attack rages across multiple fronts, targeting Randcom's technology, processes, and people, suddenly delivering a staggering blow to the company. Ayn stands in the eye of the storm, figuring a path forward. This cybersecurity case study offers an active learning and role-playing experience for students. Immersing the student in the anatomy of a cybersecurity attack, this case converges various perspectives: the hacker, the company, and the macro environment (e.g., country culture). In the process, this case highlights conflicting strategic choices and opportunity costs of decisions in an environment that requires a company to be both competitive and yet secure across three cybersecurity facets: technology, processes, and people. This case could be used as a class discussion and exercise as well as a role play with multiple protagonists. Specific roles include the CEO, the CIO, the hacker, and the CFO. This case brings together multiple viewpoints, often conflicting, representative of real-life decisional and ethical dilemmas in the context of a company. This case, further contextualized using a developing country as the backdrop, adds an additional layer of decisional trade-offs. Nonetheless, this case is representative of IS and cybersecurity decision making in a company, regardless of the type of country.