Skip to content

GCRI · Fields across the Consortium

Cyber and digital resilience

Cyber risk becomes systemic when shared software, shared providers or shared protocols let one compromise or one outage reach many organisations at once.

Make an enquiry Back to Fields across the Consortium
01Contents

Cyber and digital resilience in six parts.

In this dossier6 parts
  1. 01Three mandatesThe field, seen three ways
  2. 02The systemic questionCommon dependencies and correlated outages
  3. 03FrameworksStandards and regulation
  4. 04CouplingsDigital dependencies everywhere
  5. 05GroundingThe methods behind the field
  6. 06SourcesWhere this page’s references lead
02Three mandates

The field, seen three ways.

GRF

Governance and dialogue

AI and Digital Governance.

03Simulator

A cascade through interdependent networks.

A hazard footprint takes out co-located assets in every layer; fragmentation, dependency between layers and overload of the survivors then spread the failure. The 3D view separates the layers by depth. Teaching model with stated illustrative values, not a prediction.

Controls

Assets per layer
18
Hazard footprint
8% of area
Assets that depend on another layer
60%
Spare capacity (tolerance)
30%

Readouts

Assets hit by the hazard
17%
Assets still working
57%
Amplification of the initial damage
2.6 times
Steps to settle
2
Numbers, methods and sources
StepData centres working (%)Networks working (%)Power working (%)
0789478
1448372
2446167

Methods

  1. Interdependent networks Buldyrev and others (2010), Catastrophic cascade of failures in interdependent networks, Nature 464
  2. Overload cascades Motter and Lai (2002), Physical Review E 66
  3. Betweenness load Brandes (2001), Journal of Mathematical Sociology 25
  4. Multilayer networks Kivela and others (2014), Journal of Complex Networks 2
  5. Infrastructure interdependencies Rinaldi, Peerenboom and Kelly (2001), IEEE Control Systems 21(6)
  6. Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
  7. One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley

Data

The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page’s map can draw:

  • Major roads Natural Earth
  • Railways Natural Earth
  • Seaports Natural Earth
  • Airports Natural Earth
  • Urban extents Natural Earth
  • Night lights tonight, outages (VIIRS Day/Night Band) NASA/NOAA VIIRS (Suomi NPP) · register nasa.gibs.context-live-layers
  • Natural events (NASA EONET) NASA EONET · register nasa.eonet.events
A cascade through interdependent networks. Illustrative teaching model: it runs on the values set by the controls, not on measured data. Methods: Interdependent networks (Buldyrev and others (2010), Catastrophic cascade of failures in interdependent networks, Nature 464); Overload cascades (Motter and Lai (2002), Physical Review E 66); Betweenness load (Brandes (2001), Journal of Mathematical Sociology 25).

Across the six pillars, led by Nexus Consortium

04The systemic question

Common dependencies and correlated outages.

A widely used library vulnerability, a cloud region outage, a faulty update pushed to endpoints worldwide, or ransomware against a managed service provider produce correlated losses across sectors. Insurers and supervisors model these as accumulation scenarios; operators experience them as a dependency they could not see in their own risk register.

  • Software supply chain: provenance and integrity of components (SBOM, SLSA).
  • Concentration in cloud, identity and content delivery providers.
  • Operational technology where cyber events have physical consequences.
  • Cryptographic transition as quantum computing matures.
05Frameworks

Standards and regulation.

Framework or bodyWhat it governs or supplies
NIST Cybersecurity Framework 2.0Govern, identify, protect, detect, respond and recover
ISO/IEC 27001Information security management systems
EU NIS2 and DORACybersecurity duties for essential entities and digital operational resilience in finance
MITRE ATT&CK and CISA Known Exploited VulnerabilitiesShared threat and vulnerability knowledge
06Couplings

Digital dependencies everywhere.

The science sits on Cyber and Digital Resilience; methods start from cybersecurity.

07Grounding

The methods behind the field.

08Sources

Where this page’s references lead.

The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.

09Questions

Questions and answers.

Why does GCRI host field gateways?
GCRI hosts the shared references of the Consortium, including the STEM Commons and the field gateways, so each field has one place that links all three institutions’ work.
ReportsContribute

Contribute evidence from this page.

Reports is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.

GCRI

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

The Global Centre for Risk and Innovation

Bring a method, a dataset or a question.

Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.

Propose a method See all contact routes
Legal

Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.

Privacy choices