Cybersecurity and cryptography
Cybersecurity and cryptography protect information systems and data from unauthorised access, disruption and manipulation. They address threats that can spread rapidly across interconnected digital and physical systems. Cybersecurity and Digital Resilience stewards this page for the Nexus Consortium.
- 01InstitutionThe Global Centre for Risk and Innovation (GCRI)
- 02Service levelR0: information and enquiries
- 03In briefThe short answer
- 04The methodWhat cybersecurity and cryptography covers
- 05Reference practiceCybersecurity practice is codified in management standards and shared threat knowledge
- 06In systemic risk workAccumulation across organisations
- 07Applied inPlatforms that apply this method
GCRI · Institution · service level R0
The short answer.
Cybersecurity and cryptography protect information systems and data from unauthorised access, disruption and manipulation. Cybersecurity analysis identifies how a single compromise can propagate across sectors that share software, vendors or networks. In the Nexus Consortium, Cybersecurity and Digital Resilience stewards its canonical page, and 8 other platforms apply it, including Nexus Registry as well as Artificial Intelligence and Autonomous Systems.
Digital demand and connectivity in Indonesia.
Urban demand centres and the hubs that anchor digital and data infrastructure, shown for Indonesia as an example geography for this subject.
What cybersecurity and cryptography covers.
- 01
Core methods
threat modelling; vulnerability assessment; penetration testing; intrusion detection; cryptographic protocol design; incident response.
- 02
Data and instruments
security event logs; vulnerability databases; threat intelligence feeds; network traffic captures; incident reports.
- 03
Validation
Controls are tested through red-team exercises, audits and formal analysis of cryptographic schemes. Incident data are used to check whether defences performed as intended.
- 04
Limits
Adversaries adapt, so historical data may not reflect future attacks. Software supply chains and legacy systems introduce weaknesses that are hard to inventory.
- 05
Use in risk decisions
Cybersecurity analysis identifies how a single compromise can propagate across sectors that share software, vendors or networks. It informs resilience requirements and cyber insurance.
Cybersecurity practice is codified in management standards and shared threat knowledge.
| Reference | What it sets |
|---|---|
| NIST CSF 2.0 | Govern, identify, protect, detect, respond, recover |
| ISO/IEC 27001 | Information security management |
| MITRE ATT&CK | Adversary tactics and techniques |
| NIST post-quantum standards | Migration of public-key cryptography |
Accumulation across organisations.
Organisations manage their own cyber risk; systemic cyber risk comes from shared software, providers and protocols. Accumulation scenarios (a cloud outage, a widely exploited vulnerability) estimate how many organisations fail together, which is what insurers, supervisors and operators of critical services need to know.
- Map shared dependencies across organisations.
- Model correlated outage scenarios, not independent incidents.
- Plan cryptographic migration ahead of need.
- Applications on Cyber and Digital Resilience and Quantum.
Platforms that apply this method.
- Nexus RegistryInstitutionGCRI
- Artificial Intelligence and Autonomous SystemsInstitutionGCRI
- Cybersecurity and Digital ResilienceInstitutionGCRI
- Data and ComputeInstitutionGCRI
- Quantum TechnologiesInstitutionGCRI
- Digital Public InfrastructureInstitutionGCRI
- Fintech NexusInstitutionGRA
- Payments and Market InfrastructureInstitutionGRA
- Financial Cyber and Operational ResilienceInstitutionGRA
Who maintains this page.
Cybersecurity and Digital Resilience stewards cybersecurity and cryptography: it keeps this description current and reviews how the method is applied across the platforms.
Terms used on this page.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Threat-led penetration testing | Controlled attacks on live systems that mimic real threat actors, as in TIBER-EU. |
| Cryptographic inventory | A record of where and how cryptography is used, needed to plan migration. |
| Post-quantum cryptography | Algorithms designed to resist attack by quantum computers, standardised by NIST. |
| Ransomware | Malicious software that encrypts or locks data and demands payment for its release. |
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Where this page leads across the Consortium.
- Cybersecurity for registriesGCRIApplied in Nexus Registry.
- Cybersecurity for AI systemsGCRIApplied in Artificial Intelligence and Autonomous Systems.
- Cybersecurity practiceGCRIApplied in Cybersecurity and Digital Resilience.
- Cybersecurity for data and computeGCRIApplied in Data and Compute.
- Cryptography and quantumGCRIApplied in Quantum Technologies.
- Cybersecurity for DPIGCRIApplied in Digital Public Infrastructure.
- Cybersecurity for financial systemsGRAApplied in Fintech Nexus.
- Cybersecurity and cryptography for payments and market infrastructureGRAApplied in Payments and Market Infrastructure.
- Cybersecurity and cryptography for financial cyber and operational resilienceGRAApplied in Financial Cyber and Operational Resilience.
Questions and answers.
Why does one institution host every method page?
How do I suggest a correction to a method page?
Around GCRI.
Start with an enquiry.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.