Prioritizing investment in military cyber capability using risk analysis

Abstract

Defense capability planning traditionally uses scenario-based war-gaming to support force design decision making and to prioritize investment. Some aspects of cyber warfare are problematic for war-gaming, such as poor characterization of cyber effects and difficulty estimating the true capability of own and opposing forces. In addition, strategic-level assessments typically draw on the expert judgment of senior officers, whose tactical experience likely precedes cyber warfare, and this will limit their intuition in the emerging cyber domain. Risk analysis, and specifically the strategic risk framework, is an alternative approach to prioritizing investment in cyber capabilities, which is well-suited to analysis of cross-domain and whole-of-government functions. This paper illustrates the application of risk analysis to cyber risk for the novel purpose of developing insights for whole-of-force capability analysis.