Page 112 - Artificial Intelligence for the Internet of Everything

98 Artificial Intelligence for the Internet of Everything

government, industry, and consumer groups appears to be a critical early step
towards achieving market incentives.

5.6 CONCLUSIONS AND RECOMMENDATIONS
This article emphasizes the point that due to the risk of injuries and deaths
associated with cyber attacks on physical systems, anticipatory cybersecurity
solutions are likely to be desired, potentially much more so than has been the
case for information-system cyber security. In addition, a number of exam-
ples have been provided that illuminate both the complexity of addressing
anticipation and the difficulties associated with selecting and applying the
most critical solutions. This complexity includes recognizing the impacts
of subsystem interconnections in critical systems, such as air traffic control
systems. It has been suggested that managing the implementation of antic-
ipatory solutions will require teams of government and industrial organiza-
tions, both to address the consequences of attacks and to design systems for
detecting and responding to attacks. The examples highlight the fact that this
is an international issue, involving government as well as the relevant indus-
tries. The examples also demonstrate that standardization solutions have to
consider their monoculture implications in addition to the normal factors
that relate to standardization. In order to make progress, our education sys-
tem needs to prioritize addressing cyber security across a broader set of edu-
cation programs than is currently the practice.
Additionally, it appears likely that evidence of actual cyber attacks on
physical systems will be a necessary precursor for anticipatory solutions;
due to the associated costs, it is unlikely that self-motivation will be sufficient
to drive investment in cyber security for physical systems. The creation of
market incentives for investment in cybersecurity for physical systems will
require the engagement of government, industry, and consumer organiza-
tions. Since they are first on the scene for incidents of the kind being
addressed here, the law-enforcement community would seemingly be a log-
ical choice for collecting the needed data. Consequently, the first step in
post-event data analysis is equipping law-enforcement officers with applica-
ble equipment, so that they can identify the events caused by cyber attacks. It
is also suggested that industry members engage with the law-enforcement
community to determine the data requirements to identify a cyber attack.
Once a number of instances are documented, the policy responses suggested
above will likely increase in priority. Hopefully, with appropriate engage-
ment of consumer groups, anticipatory solutions will arise. In order for a