Cybersecurity: The Three-headed Janus. Issue 2 (November 2018)

• Record Type: Journal Article
• Authors: Diffee, Erica; Datta, Pratim
• Is Part Of: Journal of information technology teaching cases. Volume 8:Issue 2(2018)
• Page Start: 161
• Page End: 171
• Publication Date: 2018-11
• Subjects: Cybersecurity -- Cyber-attack -- Culture -- Ethics -- Hacking; Information technology -- Study and teaching -- Periodicals; Information resources management -- Study and teaching -- Periodicals; Information resources management -- Study and teaching; Information technology -- Study and teaching; Periodicals; Electronic journals; E-journal; 371.33405
• DOI: 10.1057/s41266-018-0037-7
• Languages: English
• ISSNs: 2043-8869

Abstract

Multiple entities define the stage: Ayn, an accomplished CIO; James, an idealistic CEO; Kira, an unscrupulous hacker; Randcom, a rail company; and Zuidia, a country reinventing itself. These entities intersect in a tense cybersecurity gameplay. A cyber-attack rages across multiple fronts, targeting Randcom's technology, processes, and people, suddenly delivering a staggering blow to the company. Ayn stands in the eye of the storm, figuring a path forward. This cybersecurity case study offers an active learning and role-playing experience for students. Immersing the student in the anatomy of a cybersecurity attack, this case converges various perspectives: the hacker, the company, and the macro environment (e.g., country culture). In the process, this case highlights conflicting strategic choices and opportunity costs of decisions in an environment that requires a company to be both competitive and yet secure across three cybersecurity facets: technology, processes, and people. This case could be used as a class discussion and exercise as well as a role play with multiple protagonists. Specific roles include the CEO, the CIO, the hacker, and the CFO. This case brings together multiple viewpoints, often conflicting, representative of real-life decisional and ethical dilemmas in the context of a company. This case, further contextualized using a developing country as the backdrop, adds an additional layer of decisional trade-offs. Nonetheless, this case is representative of IS and cybersecurity decision making in a company, regardless of the type of country.