GCRI · Technology
Spatial intelligenceObservations, models and their uncertainty in one view
Cybersecurity and cryptography
Cybersecurity and cryptography protect information systems and data from unauthorised access, disruption and manipulation. They address threats that can spread rapidly across interconnected digital and physical systems. Cybersecurity and Digital Resilience stewards this page for the Nexus Consortium.
Cybersecurity and cryptography on the record.
- 01InstitutionThe Global Centre for Risk and Innovation (GCRI)
- 02The methodWhat cybersecurity and cryptography covers
- 03Reference practiceCybersecurity practice is codified in management standards and shared threat knowledge
- 04In systemic risk workAccumulation across organisations
- 05Applied inPlatforms that apply this method
- 06StewardshipWho maintains this page
- 07SourcesWhere this page's references lead
What cybersecurity and cryptography covers.
- 01
Core methods
threat modelling; vulnerability assessment; penetration testing; intrusion detection; cryptographic protocol design; incident response.
- 02
Data and instruments
security event logs; vulnerability databases; threat intelligence feeds; network traffic captures; incident reports.
- 03
Validation
Controls are tested through red-team exercises, audits and formal analysis of cryptographic schemes. Incident data are used to check whether defences performed as intended.
- 04
Limits
Adversaries adapt, so historical data may not reflect future attacks. Software supply chains and legacy systems introduce weaknesses that are hard to inventory.
- 05
Use in risk decisions
Cybersecurity analysis identifies how a single compromise can propagate across sectors that share software, vendors or networks. It informs resilience requirements and cyber insurance.
Cybersecurity practice is codified in management standards and shared threat knowledge.
| Reference | What it sets |
|---|---|
| NIST CSF 2.0 | Govern, identify, protect, detect, respond, recover |
| ISO/IEC 27001 | Information security management |
| MITRE ATT&CK | Adversary tactics and techniques |
| NIST post-quantum standards | Migration of public-key cryptography |
Accumulation across organisations.
Organisations manage their own cyber risk; systemic cyber risk comes from shared software, providers and protocols. Accumulation scenarios (a cloud outage, a widely exploited vulnerability) estimate how many organisations fail together, which is what insurers, supervisors and operators of critical services need to know.
- Map shared dependencies across organisations.
- Model correlated outage scenarios, not independent incidents.
- Plan cryptographic migration ahead of need.
- Applications on Cyber and Digital Resilience and Quantum.
Platforms that apply this method.
- Nexus RegistryInstitutionGCRI
- Artificial Intelligence and Autonomous SystemsInstitutionGCRI
- Cybersecurity and Digital ResilienceInstitutionGCRI
- Data and ComputeInstitutionGCRI
- Quantum TechnologiesInstitutionGCRI
- Digital Public InfrastructureInstitutionGCRI
- Fintech NexusInstitutionGRA
- Payments and Market InfrastructureInstitutionGRA
- Financial Cyber and Operational ResilienceInstitutionGRA
Who maintains this page.
Cybersecurity and Digital Resilience stewards cybersecurity and cryptography: it keeps this description current and reviews how the method is applied across the platforms.
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Where this page leads across the Consortium.
- Cybersecurity for registriesGCRIApplied in Nexus Registry.
- Cybersecurity for AI systemsGCRIApplied in Artificial Intelligence and Autonomous Systems.
- Cybersecurity practiceGCRIApplied in Cybersecurity and Digital Resilience.
- Cybersecurity for data and computeGCRIApplied in Data and Compute.
- Cryptography and quantumGCRIApplied in Quantum Technologies.
- Cybersecurity for DPIGCRIApplied in Digital Public Infrastructure.
- Cybersecurity for financial systemsGRAApplied in Fintech Nexus.
- Cybersecurity and cryptography for payments and market infrastructureGRAApplied in Payments and Market Infrastructure.
- Cybersecurity and cryptography for financial cyber and operational resilienceGRAApplied in Financial Cyber and Operational Resilience.
Questions and answers.
Why does one institution host every method page?
How do I suggest a correction to a method page?
Contribute to Nexus Reports from this page.
Nexus Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- GatewayGW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Nexus Reports community. Curators review it there; the DOI stays yours.
- Nexus ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
The same subject across the Consortium.
- GRAglobalriskalliance.comCybersecurity and cryptography for financial cyber and operational resilienceExposure, loss and capital
- Nexus Standardsnexustandards.comFinance and payments dataStandards that apply
- Risk Academyrisksacademy.comSystemic, compound and cascading riskWhere it is taught
- Nexus Reportstherisk.globalCybersecurity and Digital Resilience in Nexus ReportsWhere it is reported
Bring a method, a dataset or a question.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.