May 7 – SoDa Seed Grant Series: Do County Demographics Shape Exposure to Cyber Harm? Exploring Socio-Economic Factors Influencing Integrated Attack Surface Size and Vulnerability

Date: May 7, 2024 Time: 12:00pm – 1:00pm Location: Zoom

Project Title: Correlating Population Demographics with Maryland’s County-Level Critical Infrastructure Vulnerabilities Abstract: Local government-controlled critical infrastructure relies on computer systems and is increasingly vulnerable to cyber-attacks that can disrupt its operation impacting citizens’ daily lives. While some research has looked at user characteristics and their susceptibility to compromise, to date there is limited research examining how vulnerabilities in government infrastructures supporting several critical services are potentially distributed in different communities. This project aims to bridge this gap by examining the relationship between exposed, and potentially vulnerable, county government services and the underlying characteristics of the communities they serve. To do so we aggregate and group publicly available internet scans into geographic locations for the communities it serves, with publicly available from the U.S. Census to conduct a series of exploratory analyses to investigate the relationships between community characteristics and the levels of potential vulnerability of county government services. We examine counties across 5 representative states across the country and find evidence of linkages between population, rural/urban divide, race, and income with changes in the size and exposure to vulnerability of county attack surfaces. Our findings suggest the need by policy makers to utilize more nuanced methods to allocate scarce resources across communities to address systemic cyber risk.

SoDa Seed Grant Award Recipient: Charles Harry, Ph.D. (PI) Director of Operations at the Maryland Global Initiative in Cybersecurity (MaGIC) Associate Research Professor in the School of Public Policy and College of Information Studies Senior Research Associate at CISSM University of Maryland

Charles Harry is a senior leader, practitioner, and researcher with over 20 years of experience in intelligence and cyber operations. Harry is the director of the Center for Governance of Technology and Systems (GoTech) and Associate Research Professor in the School of Public Policy. He holds a joint appointment in the College of Information Studies and serves as the operations director for the university’s Maryland Global Initiative for Cybersecurity (MaGIC) and is a Senior Research Associate at the Center for International and Security Studies at Maryland (CISSM) and an affiliate at the Applied Research Laboratory for Intelligence and Security (ARLIS). Harry’s research focuses on categorization and measurement of effects of cyberattack as a means of enabling policy makers to assess strategic risk and assess consequences of strategic cyber-attack. His research and commentary have been featured in peer reviewed publications and has been referenced in a variety of print, radio, and televised media including the Wall Street Journal, Wired, WTOP, NPR, al-Hurra, Breaking Defense, Scientific Sense, the Conversation, and the Washington Post. He actively consults for a range of private and public sector organizations including the Department of Energy and serves as part of Bain and Company’s external advisor network. Harry teaches undergraduate and graduate courses in cyber policy, security policy, and quantitative methods, and has published a popular cyber policy course offered on the Coursera platform. Harry has also co-founded a University of Maryland incubated start-up, Decision Point Analytics, to assist governments and organizations model and understand systemic risk in their organization and supply chains. Prior to his work with the university, Harry led and grew a cybersecurity consulting organization combining analysts and developers to deliver innovative solutions to the private and public sector. His public service includes a 14-year career with the National Security Agency rising to the rank of senior technical leader (DISL). He has supported senior policy makers at the White House and has regularly appeared before congressional committees to provide testimony. Harry holds degrees in economics and history from the University of Colorado and was awarded a PhD in policy studies from the University of Maryland. He is a two-time recipient of the Director of National Intelligence Extraordinary Achievement Medal, the Signal Intelligence Career Achievement Medal, and the ODNI Intelligence Integration Medal.

William Lucyshyn (Co-PI) Research Professor and Director of Research Center for Governance of Technology and Systems (GoTech) School of Public Policy University of Maryland

William Lucyshyn is a Research Professor and the Director of Research at the Center for Governance of Technology and Systems (GoTech) in the School of Public Policy at the University of Maryland. He has authored numerous reports, book chapters, and journal articles on various subjects, including the economics of cybersecurity, the sustainment of complex systems, identifying public sector acquisition best practices, and public and private sector partnering. Previously, Mr. Lucyshyn served as a program manager and the principal technical advisor to the Director of the Defense Advanced Research Projects Agency (DARPA) on the identification, selection, research, development, and prototype production of advanced technology projects. Prior to that, he completed a 25-year career in the U.S. Air Force, serving in various operations, staff, and acquisition positions. Mr. Lucyshyn received his bachelor’s degree in engineering science from the City University of New York in 1971. In 1985, he earned his master’s degree in Nuclear Engineering from the Air Force Institute of Technology.

Industry Expert Commentator: Netta Squires Director of Local Cybersecurity State of Maryland

Crisis Management specialist experienced in legal compliance, emergency management planning, cybersecurity, public health, and mass care.

SoDa Seed Grants: The projects under this initiative may address any societal challenge that affects a large number of people, including but not limited to health, public safety, justice, race, gender, education, employment, transit, and political representation. The goal of these seed grants is to encourage faculty to develop collaborative projects that stimulate the advancement of new ideas that can build the university’s expertise toward a national reputation in the broad area of social data science. The projects blend the development or use of innovative data science methods or new measurements, the advancement of scholarship within or across disciplines, and progress in addressing a societal challenge.