The form drives the design of the database; changes to the form require either a process of adjusting older data or understanding that some queries cannot be run across the full historical data. Within the workshop there was substantive disagreement over the costs and benefits of forms and taxonomies. What is clear is that trend analysis, an important function of the actual NTSB and ASRS, would be greatly aided by standardizing reporting forms and taxonomies. It is also clear that such taxonomies would enable some forms of research, and inhibit others. For example, a form could say “did the attacker get in via ☐ Hacking ☐ social engineering;” or it could say “did the attacker get in via ☐ SQL injection ☐ buffer overflow ☐ phishing ☐ sophisticated methods.” The structure of a form represents the expectations of the creators of the form, and so there is a tradeoff between trend analysis and other goals.
How Should a Board Select What to Investigate? There are a lot of cybersecurity incidents. For an indication of the scale, in the second half of 2018, 41,502 breaches were reported to European authorities under the General Data Protection Regulation.43 While we are not aware of such a cross-sectoral, broad-based number for the United States, it is likely that similar reporting criteria in the United States would produce a comparable number of breaches. Even with limited awareness, there are too many incidents to investigate each one. Thus, investigative bodies will require clear criteria for selecting incidents to investigate.
FINDING: A Board will require criteria for selecting events to investigate In the creation of the CSRB, the President established criteria for its reviews that are tied to the standup of the Unified Coordination Group 43
24
Supreeth Shastri, Melissa Wasserman, and Vijay Chidambram, “GDPR Anti-Patterns,” Communications of the ACM, February 2021, https:// cacm.acm.org/magazines/2021/2/250081-gdpr-anti-patterns/ fulltext?mobile=false
Learning from Cyber Incidents: Adapting Aviation Safety Models to Cybersecurity
