Dealing with uncertainty in cyberspace

1. Introduction

Cyberspace has been labelled as the most complex system mankind has ever made (Risk Nexus, 2014; Van den Berg and Kuipers, 2022). Its rapid development and massive adoption have led to a challenge: we have quickly become “utterly dependent on a technological system that is both very disruptive and yet is poorly, if at all, understood” (Naughton, 2016, p. 5). The global character of cyberspace, its vast number of users and interconnections and its rapid technological development contribute to a sense of uncertainty surrounding cyberspace. While nation states, organizations and end users all see the tremendous potential that a globally interconnected network offers, at the same time it has become clear that this space produces a wide variety of risks, for which no easy solutions exist (Giddens, 1999; Rasmussen, 1997).

In recent decades a sense of uncertainty has increased among nation states, in the private sector and among the public in light of three connected and mutually influencing trends: globalization, rising complexity in geopolitics and growing interconnectedness due to the use of digital network technologies. Globalization here refers to a set of social processes that lead to increased globality, which is a “social condition characterized by the existence of global economic, political, cultural, and environmental interconnections and flows that make many of the currently existing borders and boundaries irrelevant” (Robertson and White, 2007). Key elements of the notion of globalization that are mentioned in the literature are the disappearance of borders (Robinson, 2007; Steger, 2003), the fact that the capitalist economy has become the global norm (Antonio, 2007; Thompson, 1999) and increased cultural flows across the globe (Steger, 2003). While these developments have had great economic and political advantages, they are also seen to be an important source of uncertainty. A related development is that of increasing instability in geopolitics. Since the end of the Cold War, we have witnessed the demise of traditional blocks of power in international politics (Robertson and White, 2007), more opportunistic and short-lived partnerships between nation states and more rapid dynamism in the alliances that nations states make with other nation states. These developments lead to tension in the international arena. In the words of Robertson and White, “the present international system is in a state of great and puzzling flux.” (2007, p. 61). The rise of populism and increasing polarization in countries around the world in recent times fit with this phenomenon (Rohac, 2024). A final interrelated phenomenon is the rise of digital network technologies over the past few decades. Information and communication technologies have been tied into networks that now span the globe, facilitating instantaneous information-sharing and means of communication. Collectively, these networks form an ecosystem of incredible complexity, called cyberspace. On the one hand, the rise of digital networked technologies has strengthened globalization (Demchak, 2012), on the other the global spread of cyberspace can also be considered an effect of globalization. Over the past decades, cyberspace has come to function as a critical backbone of economies around the globe (Demchak, 2012; Shull, 2019), and an essential part of the everyday activities of end users.

Combined, globalization, increased geopolitical instability and the rise of digital networked technologies lead to more uncertainty for the international community, for nation states, for organizations and even for individuals. It is not surprising, therefore, that these different actors seek to use means to ‘tame’ this uncertainty, to reduce risk, ambiguity and insecurity. This article discusses five common strategies that are used by different actors to reduce uncertainty in cyberspace. Understanding these strategies enables us to assess the merits and weaknesses of each strategy and develop an approach to choosing particular strategies for particular challenges in cyberspace. The following five broad strategies will be distinguished:

• (1)

  seeking to reduce uncertainty through gaining more control, using risk management;

• (2)

  increasing the adaptability of systems to withstand incidents through the notion of resilience;

• (3)

  decreasing uncertainty by steering or influencing the behaviors of actors in cyberspace through regulation;

• (4)

  suspending uncertainties by using trust; and

• (5)

  ignoring uncertainties by choosing not to act on them.

In the next sections each strategy will be discussed in more detail.

2. Risk management: controlling uncertainty

Risk management is the dominant paradigm of dealing with risk in our modern times (Anton and Nucu, 2020; Power, 2004). Early forms of risk management emerged in the middle of the 20th century in response to questions of the insurability of risk (Dionne, 2013). It then became a solidified approach for controlling risks in different domains, for example in the financial sector and in public health. In recent decades, risk management has also become a key activity in organizations, which seek to reduce risks internally but also regarding the products or services they deliver to customers. Risk management is most well-known for its contributions to engineering, especially in relation to the development of new systems and technologies, including digital, networked technologies (Power, 2004).

3. Resilience: recovering from uncertainty

The first of these is resilience. This term has gained prominence in policy documents, in crisis management strategies and more broadly in approaches to dealing with uncertainty in the safety and security realm (cf. Dahlberg, 2015; Demchak, 2012; Perelman, 2006; Suter, 2011; Woods, 2015). It has also become a prominently used approach in relation to uncertainties in cyberspace. The notion of resilience does not have a clear definition. Different views on what resilience is or how it could be accomplished have emerged. Three main interpretations of resilience can be distinguished:

• (1)

  resilience as a form of protection;

• (2)

  resilience as preparedness; and

• (3)

  resilience as the ability to adapt.

4. Regulation: influencing uncertainty

While risk management seeks to control uncertainty in cyberspace and resilience aims to improve the ways in which systems can recover from incidents, a third response to dealing with uncertainty in cyberspace is to regulate the behaviors of actors that make use of this space or contribute to its production. The essence of regulation is steering behavior in certain directions. This is also a way of taming uncertainty because the predictability of actors may be increased in specific contexts.

Regulation in relation to cyberspace takes various forms. In some cases, actors’ behaviors are regulated through the architecture of the network. This has come to be known as techno-regulation (Benoliel, 2004; Brownsword and Yeung, 2008; Kerr, 2010; Koops, 2011; Leenes, 2011; Lessig, 2006; Nissenbaum, 2011) and nudging (Acquisti, 2009; Calo, 2013; Fogg, 2003; Johnson et al., 2012; Yeung, 2008). In other cases, social norms emerge between different stakeholders in cyberspace, which collectively shape what communities deem to be appropriate behavior in specific contexts (Farrell, 2015; Finnemore and Hollis, 2016; Lessig, 2006). Market forces may also regulate, steer and influence the behaviors of actors in cyberspace (Bradford, 2012). And finally, legal frameworks can regulate behavior in cyberspace. In principle, it is challenging to use laws to regulate behavior in cyberspace, because this space transcends national borders and spans the globe. At the same time, in the past decades nation states and regional entities such as the European Union have sought to create legal frameworks for specific legal challenges in cyberspace, which are applicable to their territories. Three different kinds of regulation can be distinguished: ‘inside-in regulation’, ‘inside-out regulation’ and ‘outside-out regulation’.

5. Trust: suspending uncertainty

A fourth strategy to deal with uncertainty is to accept that it exists, but to suspend it to be able to act under ambiguous conditions. This is exemplified by using trust as a response to uncertainty. In this case, one accepts that there is a fundamental uncertainty, that full control is principally unattainable and that it is unconstructive to seek such control. Instead, one embraces the idea that despite the fact that there is no full control, systems and people can be trusted, relied upon, to function in a predictable manner – at least to some extent and under certain conditions (Keymolen and Van der Hof, 2019; Van den Berg and Keymolen, 2017). Complexity is reduced through trust; it enables us to act against a backdrop of high ambiguity and variability (Luhmann, 2017, 2000). When we trust others or systems, we temporarily put complexities between brackets, and act as if the outcome of whatever it is we are engaging in is predictable and stable (Van den Berg and Keymolen, 2017).

Trust can act as a strategy with respect to uncertainty in cyberspace on several levels:

• (1)

  Using cyberspace requires trust in systems, in code, in data, in the organizations and governments that facilitate this ecosystem's functioning, and in the organizations and individuals that we connect with via cyberspace (Henschke and Ford, 2016). Debates about cybersecurity rightfully focus on fostering and strengthening trust in cyberspace on a regular basis (Henschke and Ford, 2016).

• (2)

  Trust acts as a key mechanism in relation to the adoption of processes, procedures and approaches to increase cybersecurity. Risk management has come to function as the dominant strategy for cybersecurity, but as of yet there is little scientific evidence of its effectiveness in this domain. The adoption of risk management for cybersecurity may therefore be viewed as an act of trust.

• (3)

  Trust is also used as an explicit cybersecurity strategy: it is used to reduce uncertainty with respect to security in and of cyberspace (Van den Berg and Keymolen, 2017). This is the case whenever individuals or groups are mobilized to contribute to making parts of cyberspace more secure. Think of, for example, vulnerability disclosure programs in which end users bounty hunt for vulnerabilities in the systems of large internet companies or platforms. Vulnerability disclosure programs build on a mutual sense of trust: companies must trust individuals to scan their code and not take advantage of vulnerabilities they find. At the same time, the individuals participating in these vulnerability disclosure programs must trust the company to take seriously their work, to act on their discoveries and to credit their efforts.

6. Doing nothing: ignoring uncertainty

The previous four strategies all take an active stance towards uncertainty in cyberspace: they all aim to do something in the face of this uncertainty. A final strategy, however, of dealing with uncertainty in cyberspace, is to not only radically accept that it is a fundamental characteristic of this ecosystem, but also to do nothing in response to its manifestations. Currently this strategy is not practiced very often in the field of cybersecurity. Researchers and practitioners in the field sometimes express concern over the lack of response to encountered risks in cyberspace by business leaders or government representatives and plead for more active engagement with those risks (Blau, 2017; Epper Hoffman, 2018; Georg-Schaffner and Prinz, 2021). There is ample evidence of the frequency and impact of cybersecurity incidents and not acting on the most well-documented vulnerabilities and threats may therefore be considered a harmful strategy. Meeting so-called ‘baseline cybersecurity’ is essential for organizations’ survival in an age of pervasive networked, digital technologies (Chaturvedi et al., 2021; Dezeure et al., 2024; Oladoyinbo et al., 2023). When ‘doing nothing’ equals ‘ignoring cybersecurity risks’, this seems unwise.

Many organizations today have cybersecurity high on their agendas (Georg-Schaffner and Prinz, 2021). At the same time, discussing cybersecurity challenges in the board room does not always lead to the right level of action yet, since boards often struggle to know what decisions to make with respect to cybersecurity (Epper Hoffman, 2018) and what level of investment is sufficient (Blau, 2017). In some cases, therefore, organizations do not act on cybersecurity risks because they are overwhelmed or undermotivated, or they lack capabilities, capacities or funds. While this may be an unwise strategy, it is also understandable considering the rapid development of new technologies and their associated risks, as well as the impenetrability of technical expertise required to understand them.

But there may also be other reasons to not act in relation to uncertainties in cyberspace and in some areas this could be considered a valid strategy. Doing nothing may entail a wait-and-see-approach. This strategy is particularly relevant in all instances where it is still unclear how significant or impactful a particular vulnerability or risk is. When solid data is lacking (De Bruijne and Van Eeten, 2007; Mulligan and Schneider, 2011; Pawlak and Wendling, 2013), it can be rational to accept uncertainty as a given and not act upon it (Trimintzios et al., 2014). Moreover, interventions involve costs and benefits. When the former outweigh the latter, it is reasonable to ignore risks and accept specific uncertainties.

Of course, embracing a tactic of inaction can only be adopted for some organizations, for some processes, systems and networks, and for some types of uncertainties. This applies to all the strategies discussed above: they work well under certain conditions and can be used to address some specific uncertainties in cyberspace, but none ought to be used across the board. As a matter of fact, using a mixture of different strategies for different contexts and challenges would be best.

7. Different strategies for different problems. or not?

As this article has shown, in the current cybersecurity landscape the dominant way of thinking about uncertainty in cyberspace is through the lens of risk management. In recent years, there is a noticeable shift towards resilience as a second strategy that complements the risk management paradigm. Risk management and resilience may be seen as complementary in the sense that the former focuses on the prevention of incidents, while the latter has a role to play once incidents have materialized. On a timeline, therefore, risk management focuses on what can be called ‘left of bang’ (Lester and Moore, 2020), while resilience focuses on being prepared for the bang and on what we could call ‘right of bang’ (Baskerville et al., 2014). Increasingly, researchers and practitioners also see potential for regulation as a strategy to deal with uncertainty in cyberspace. For a long time, regulation was considered a rather weak mechanism for cyberspace. Pointing to the global nature of cyberspace, and the power of private parties, who own and operate the vast majority of all architecture and services in cyberspace (Demchak, 2012; Goldsmith and Wu, 2008), the central assumption was that influencing actors’ behavior in cyberspace through regulation would not be an effective strategy. Over time, this view has changed, in part because discussions have tended to focus more concretely on, for instance, standard-setting and certification (Amoroso and Amoroso, 2017; Shackelford et al., 2015), in part due to the fact that governments have taken a clearer regulatory stance vis-à-vis cyberspace and especially large internet companies (Naughton, 2016), and in part due to the noticeable effects of regulatory interventions, as shown in our discussion of the Brussels effect (Bradford, 2012; Schneier, 2018).

Using trust or doing nothing (in the sense of delaying a response) are currently not considered as common strategies on any significant scale. Both have their merits under certain conditions. As Keymolen points out, it is obviously unwise to address the security challenges of a nuclear power plant through trust mechanisms (Van den Berg and Keymolen, 2017) but trust might be a useful strategy in all those instances where ordinary citizens or end users could be mobilized to help make cyberspace more secure. The same goes for doing nothing. In a reality in which not only the vulnerabilities but also all the solutions that are provided for them are shrouded in urgency and mystery, it is sometimes wise to take a little more time to understand the size, the likelihood and the potential impact of incidents, before adding yet another issue to the decision makers’ cognitive load. This is especially the case for all issues and solutions for which substantial data are lacking or the costs of interventions are high.

8. Dealing with uncertainty in cyberspace: using all tools in toolbox

This article shows that there is a wide variety of uncertainties in cyberspace due to its complex makeup, and that there is also an assortment of possible responses to these uncertainties. As a matter of fact, oftentimes vulnerabilities, threats and risks are best addressed using a mixture of different strategies. They complement and strengthen each other. Regulation works best in a reality in which shared norms already exist, while shared norms and regulation foster and are fed by trust. Similarly, resilience thrives when basic risks have been managed properly, while risk management is most conducive in environments that also focus on preparedness for eventual incidents.

Each of the individual responses to uncertainty that have been discussed in this article have their merits and weaknesses. Risk management works best for all so-called ‘subway uncertainties’ (Makridakis et al., 2009): uncertainties that appear with relative regularity, so that they can be predicted using probabilistic mathematics. This kind of uncertainties follows a Bell curve pattern and materialize with such constancy that their occurrence can be quantified. When the impact of the materialization of this kind of risk is also fairly well-known, risk management can come to its maximum potential: it can help quantify and prioritize risks of the highest urgency. A clear example of a type of uncertainty that can be addressed well using risk management is combatting DDoS attacks. Due to the regularity and volume of such attacks, over the past years organizations have learnt to understand anomalies in network traffic to such a degree that they may now see DDoS attacks coming early on and have risk management interventions in place to prevent the debilitating effects of such attacks.

Resilience can be used be to prepare for so-called ‘coconut uncertainties’ (Makridakis et al., 2009): for very rare known unknowns or for unknown unknowns (also known as Black Swans) (van Asselt and Renn, 2011; Taleb, 2010; Zio, 2018). To do justice to the complexity of cyberspace, and to the potential of cascading effects (Cedergren and Johansson, 2017; Luiijf et al., 2008), butterfly effects (Dekker, 2011), and the effects of tight coupling (De Bruijne and Van Eeten, 2007; Demchak, 2012; Perrow, 1984), incident planning and investment in recovery efforts is necessary. The current trend of ransomware is one of these areas where a resilience approach works best. Defense-in-depth and a Swiss Cheese model approach enable organizations to create defensive layers to face this challenge as well as they possibly can, while also allocating time, effort and means for crisis management should the defenses fail. The same holds for highly advanced attacks by APTs: a combined focus on multiple layers of defense combined with preparedness for incidents is currently the most viable strategy to face this threat.

Regulation has potential for two problem areas: addressing uncertainties caused by weak design and thwarting the deliberate exploitation of vulnerabilities by malicious actors. Weak design leads to vulnerabilities in code, configurations, processes and communications. Regulation can help remedy this issue by setting standards for technology design and service delivery, and it can help foster trust through, e.g., certification, standardization and oversight. Malicious actors of a wide variety may willfully exploit vulnerabilities in cyberspace and are, therefore, one of the biggest sources of uncertainty in this ecosystem. Regulation may have a deterrent effect on such abuse and may lead to prosecution and punishment in case of actual transgressions.

Trust can be used as a viable strategy to deal with uncertainties when implicit normative frameworks already exist, in contexts in which interpersonal connections are essential, and in which harm is limited in cases of transgression. One area where this is fruitful is information sharing with respect to threats or zero days or vulnerabilities. In different countries around the globe, public-private collaborations have emerged, in which parties share information on these topics (Weiss and Jankauskas, 2018). Some of these collaborations take the form of informal networks, whereas others are more formally organized. It is especially in the former category that trust is one of the key drivers (Henschke and Ford, 2016).

Finally, doing nothing is suitable for uncertainties where data on likelihoods is lacking but there is sufficient evidence that no severe harm will be done in the case of incidents. When new threats emerge on the horizon, it oftentimes remains difficult for quite some time to get a sense of the likelihood with which they will materialize, and the conditions under which they will do so. Reliable data on incidents relating to this kind of threat are not easy to come by. If, on top of this, the impact of an incident would be limited, then it is safe to take a wait-and-see-response. An example of this kind of uncertainty in cyberspace is the discovery of vulnerabilities that do not lead to serious system risks and are labelled ‘low/low’ by (inter)national organizations that label emerging threats.

Collectively, risk management, resilience, regulation, trust and doing nothing can be seen as different tools in a toolbox. For some challenges, a hammer works best, and for others a saw or a set of pliers. The same goes for responding to different uncertainties in cyberspace. Choosing the right tool for the right problem would strengthen cybersecurity efforts across the board and decrease uncertainty in cyberspace to a considerable degree.

CRediT authorship contribution statement

Bibi van den Berg: Conceptualization, Formal analysis, Investigation, Methodology, Resources, Writing – original draft, Writing – review & editing.