Information Technology Sector Risks and Future Resiliency Deborah Frost, IMT 556, Winter 2015, University of Washington iSchool

Information Technology Sector Functions Provide: IT products and services Domain name resolution services Identity management and associated trust support services Internet-based content, information, and communication services Incident management capabilities Routing, access, and connection services

Mitigation Activities Operational Risks and Mitigation Activities IT Products & Services Production or distribution of untrustworthy critical product through a manmade deliberate attack on a supply chain vulnerability Supply chain resilience and process controls Supply chain security and integrity DNS Breakdown of single interoperable Internet through manmade attack and failure of governance Operations diversity and redundancy Operations quality assurance and continuous monitoring Content, info, communication Manmade unintentional incident causes significant loss of e-commerce capabilities Policy and access controls Security training for users and small businesses Enhance rerouting capabilities of the Communications and IT Sectors

Mitigation Activities Operational Risks and Mitigation Activities Routing, access, connection services Partial or complete loss of routing capabilities through a manmade deliberate attack on the Internet routing infrastructure Enhanced routers Ability to mitigate disruptions to Internet access Physical security of Network Access Points and Internet Exchange Points Improved incident response Incident management Impact to detection capabilities because of a lack of data availability resulting from a natural threat National-level incident response and coordination capabilities Distributed infrastructure and workforce Information sharing enhancements creating common situational awareness

Private Sector Risks Similar Single source for parts and materials/Third-party reliance to make product whole Natural disasters impact on key company locations System security and cyber attacks Reliability of infrastructure to support product and services Privacy and security of customer’s information Errors or defects within own product Data breaches Unique Speed of technology changes and interoperability Intellectual property rights protection and infringement claims Attract and retain key personnel Volume of demand for services Systems and process changes related to acquisitions

Future Resiliency Focus on employees, STEM education Clarify regulation and oversight responsibilities Complete identity management risk assessment Continue multi-stakeholder, diverse and transparent collaborations in developing future governance roles