government–industry cooperation in performing cybersecurity validations, perhaps including “red teaming” to test security. It should apply the same tests to government’s connections to the private-sector IT systems.
Finally, this task might develop a set of cybersecurity guidelines and recommendations, or at least suggest a methodology to determine how much security is enough. It could analyze how to promote the use of such guidelines most effectively.
Task 5. Assess the economic impacts of cost increases in the freight transportation industry. Some cybersecurity measures may bring with them corresponding economic benefits. For example, the use of digital signatures might reduce costs related to errors and fraud detection and management. The resulting improved service could also increase customer confidence. However, certain measures might protect against low-likelihood but very high-consequence events, such as those that may help enable the transport of weapons of mass destruction. Such measures are less likely to have ancillary benefits but could result in significant additional costs. The public might benefit from a reduction in the risk of a catastrophe, but the companies making the investment may not. Even cost-effective measures may be problematical for companies that are making no profit. The costs of increased cybersecurity could ultimately affect all companies that rely on the transport industry. This task should deal with the following issues:
At what levels and distribution of costs for security does the economic impact become a concern, for the freight industry itself, its users, and the U.S. economy?
On the basis of existing models for relating economic inputs and outputs, what changes in economic outputs might result from varying levels of investment in security?
Given the tight margins associated with the freight industry, is there a significant possibility of economic damage to the companies that constitute this industry?
For investments that may be needed for national security purposes but that provide little or no advantage to the company implementing the measures, what form of government participation (e.g., tax credits) would be most effective?
Results should be quantitative and be developed for a wide set of assumptions in order to permit consideration of a significant range of possible outputs.