The survey instrument
The survey itself will consist of a limited number of questions, focused on cybersecurity issues that matter to industry professionals, and repeated month after month. For the first run, questions will be as follows. While we want the question set to be stable over the long run, initial jiggles may be indicated.
Responses will be amongst five multiple choices – falling fast, falling, static, rising, rising fast.
ICS survey questions
Each of the survey questions below is responded to on a five point scale, with the respondents rating the risks as having fallen fast, fallen, stayed static, risen or risen fast when compared to the previous month.
1. Attack actors:
Compared to last month, the threat to your organization from the following actors has [fallen fast, fallen, stayed static, risen or risen fast]:
1.1. Insider threat: In your view, the risk from malicious insiders (with both opportunity and motivation)
1.2. Strategic rivals: The likelihood that there exist attacks explicitly targeting economically valuable data within your organization
1.3. Activists/hacktivists: Your exposure to politically or ideologically motivated activity (whether local or abroad)
1.4 Criminals: The threat to your organization from criminally motivated attackers
1.5. Nation-states: The degree to which you are a target for nation-state actors
2. Weapons:
Compared to last month, the threat from the following attack paths has [fallen fast, fallen, stayed static, risen or risen fast]:
2.1. Botnets
2.2. Mass malware
2.3. Vulnerability exploitation
2.4. Phishing / social engineering
2.5. Attacks customized to your organization
3. Effect desired by attackers:
Compared to last month, the risk from attack motivations listed below has [fallen fast, fallen, stayed static, risen or risen fast]:
3.1. Data theft (Confidentiality)
3.2. Data modification (Integrity)
3.3. Business disruption (Availability)
4. Attack targets:
Compared to last month, the risk via the following targets for your organization has [fallen fast, fallen, stayed static, risen or risen fast]:
4.1. Web facing applications
4.2. Internet exposed devices and appliances
4.3. End point desktops
4.4. Mobile devices
4.5. Public infrastructures you rely upon including cloud
4.6. Third parties (counterparties, vendors, partners etc) who have rightful access to your data
4.7. Network-connected but autonomous devices (collectively known as the “Internet of Things”)
5. Defenses:
Compared to last month, what is your view of:
5.1. Vulnerability of available defenses to known threats
5.2. Vulnerability of available defenses to unknown threats
6. Overall perceptions:
Compared to last month, what is your view of:
6.1. Ability to detect false digital claims of identity when received by/presented to machines/functions for which you are responsible
6.2. Media and public perception of cyber risks affecting the general populace
6.3. Your personal risk from online activity including commerce