GCRI · Cybersecurity and Digital Resilience
Methods and uncertainty
The methods Cybersecurity and Digital Resilience relies on: their equations and assumptions, the data they need, how they are validated and the limits of what they can show.
Methods and uncertainty in five parts.
The methods in use.
- 01Cybersecurity and cryptographyControl baselines and gap analysis · Exploited vulnerability prioritisationApplied here
- 02Software and safety-critical systems engineeringSecure development life cycle · Safety and security co-assuranceApplied here
- 03Communications and network technologyNetwork segmentation design · Protocol security review · Post-quantum protocol readinessApplied here
- 04Network science and contagionAttack path analysis · Digital dependency concentration · Coordination detectionApplied here
- 05Reliability and resilience engineeringRecovery architecture · Degraded operation modes · Recovery time testingApplied here
- 06Quantum computing, sensing and communicationQuantum threat timeline assessment · Comparing PQC and QKD · Data lifetime analysisApplied here
Each method, its role in this field and how it is checked.
- CybersecurityRole hereCybersecurity and cryptography is the technology this platform stewards for the network.Checks appliedControl testing; Detection validation; Framework mapping review
- Safety critical softwareRole hereSoftware and safety-critical systems engineering builds software that must not fail dangerously, in medical devices, vehicles, control systems and infrastructure.Checks appliedIndependent verification; Coverage measures; Vulnerability root cause tracking
- CommunicationsRole hereCommunications and network technology carry the traffic that security protects and attackers target.Checks appliedFlow verification; Configuration review; Interoperability testing
- Network scienceRole hereNetwork science represents systems, dependencies and actors as graphs.Checks appliedPath validation; Threshold sensitivity; Ground truth comparison
- Resilience engineeringRole hereReliability and resilience engineering keeps digital services running through failures and attacks.Checks appliedRestore testing; Isolation verification; Exercise realism
- Quantum technologyRole hereQuantum computing, sensing and communication matter to digital resilience mainly through cryptography.Checks appliedPeer-reviewed sources; Range reporting; Agency alignment
How the process runs.
Process explorer · Process
Methods and uncertainty: Source to evidence record
10 steps·4 stages·2 gates
Process
Methods and uncertainty: Source to evidence record
A source is registered and assessed, its record labelled and classified, and a Digital Evidence Passport carries provenance; a correction reaches every dependent record.
01 Intake
- 01Identify the sourceSource · The source stewardDiscovery is not ingestion. Source identification records the source class, steward, institutional role and jurisdiction.
- 03Register the sourceStepRegistration makes a discovered source a governed participant in the evidence lifecycle. It implies no endorsement or certification.
02 Assessment
- 04Jurisdiction and rights classificationGateRights classification identifies licence, consent, confidentiality and reuse limits. The result determines access and routing.
- 05Evidence quality assessmentStepQuality assessment decides whether a record is fit for a defined use. Quality is multidimensional and never a single score.
- 06Evidence labelStepEvery finding carries one of nine evidence labels. Missing data is shown as missing, never as zero.
03 Record
- 07Evidence classificationRecordClassification gives records lifecycle states, such as source-verified, public-safe or restricted. States can coexist and set evidence use.
- 08Source release and identifierRecord · NXS-GRX (canonical data, provenance and risk)A source release records rights, temporal coverage and source lineage. A UNI is allocated through a catalogue and never typed by hand.
- 09Digital Evidence PassportRecordThe passport records provenance, quality, rights, jurisdiction, permitted use and history, so evidence keeps its context when it travels.
04 Use and correction
- 02Correction reaches dependent recordsStep · NXS-GRX (canonical data, provenance and risk)A source correction propagates to dependent cuts and products without rewriting old results.
- 10Public-safe reviewGatePublic-safe review decides whether a record can be shared publicly. It is a distinct stage and is not validation.
Data protocols: evidence lifecycle · Data protocols: core data objects and evidence records · The Global Risks Index (NXS-GRX)Designed programme process, not a record of operation. No cycle has run and every programme is at service level R0. A gate is a programme decision, never a public-authority approval, certification or deployment authorisation. The data-protocol pages describe a design, not a running system.
Where uncertainty in cyber analysis comes from, and how it is shown.
| Source | Why it matters here | How it is reported |
|---|---|---|
| Incident data | Under-reporting and inconsistent definitions | Sources and definitions stated |
| Dependency maps | Providers rarely disclose dependencies | Inferred links labelled |
| Attack likelihood | Adversaries adapt | Scenarios rather than probabilities |
| Loss estimates | Indirect losses hard to measure | Ranges with methods |
Accumulation scenarios state the dependency assumptions and the share of affected organisations assumed.
How uncertainty is reported.
- 01
State assumptions
Each analysis lists its assumptions and the data it depends on.
- 02
Quantify where possible
Ranges and confidence are reported alongside central estimates.
- 03
Validate and compare
Models are checked against observations and, where possible, against other models.
- 04
Publish limits
What an analysis cannot show is stated beside what it can.
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
Are the methods open?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.