Understanding the cybersecurity threat landscape is critical to mitigating threats, apportioning limited resources, and hosting a resilient, safe, and secure Olympic Games. To support the security goals of Tokyo 2020, this report characterizes the cybersecurity threats that are likely to pose a risk to the games, visualizes a threat actor typology, and presents a series of policy options to guide cybersecurity planning.

Cover: Olympic-Caliber Cybersecurity
Read Online

Olympic-Caliber Cybersecurity

Lessons for Safeguarding the 2020 Games and Other Major Events

by Cynthia Dion-Schwarz, Nathan Ryan, Julia A. Thompson, Erik Silfversten, Giacomo Persi Paoli

Download

Download eBook for Free

FormatFile SizeNotes
PDF file 1.6 MB Best for desktop computers.

Use Adobe Acrobat Reader version 10 or higher for the best experience.
ePub file 1.3 MB Best for mobile devices.

On desktop computers and some mobile devices, you may need to download an eBook reader to view ePub files. Calibre is an example of a free and open source e-book library management application.
mobi file 2.9 MB Best for Kindle 1-3.

On desktop computers and some mobile devices, you may need to download an eBook reader to view mobi files. Amazon Kindle is the most popular reader for mobi files.

Purchase

Purchase Print Copy

 FormatList Price Price
Add to Cart Paperback96 pages $21.00 $16.80 20% Web Discount

Research Questions

  1. What does the cybersecurity threat landscape of the Tokyo 2020 Olympics look like?
  2. What lessons can be learned from previous Olympic Games?
  3. Which actors pose a cybersecurity threat to Tokyo 2020, and what policy options can help planners mitigate these risks?

The Olympic Games are a target-rich environment for cyberattackers, drawing athletes, attendees, and media coverage from around the world. Japan's vision to become the most advanced urban technology metropolis in the world underpinned its bid to host the 2020 Olympics, but an increasing dependence on technology with each successive Olympic Games signals a shift toward an unpredictable, complex, and contested cyber threat environment. More than ever, security planners must consider the cybersecurity threat landscape if they are to effectively mitigate threats, apportion limited resources, and host a resilient, safe, and secure Olympic Games.

To support the security goals of Tokyo 2020, this report characterizes the cybersecurity threats that are likely to pose a risk to the games and presents a series of policy options to guide planners and other stakeholders in addressing them. The analysis involved a risk assessment synthesizing qualitative and quantitative data on the threat landscape and lessons from prior Olympic Games. Underlying the risk assessment is a threat actor typology — a classification and ranking of a range of threats to the security of the games. A key contribution of this research is a visualization of this threat actor typology that provides an at-a-glance overview to guide Olympic security planners, computer emergency response teams, and policy- and decisionmakers as they prioritize and address cybersecurity threats in the lead-up to Tokyo 2020.

Key Findings

Cyber threats are a growing concern for Olympic planners, and past games hold valuable lessons for Tokyo 2020

  • The increasing dependence on technology and a proliferation of adversary tools to exploit vulnerabilities in systems and networks make the Olympic Games a target-rich environment for cyberattackers.
  • The consequences of a cyberattack on the Olympic Games include financial losses, physical harm to participants and attendees, property damage, the compromise of personal information, and damage to the host country's reputation.
  • There have been no successful large-scale, high-impact attacks on prior Olympic Games; experiences from these and other international events offer potential lessons for Tokyo 2020 planners.
  • A key characteristic of past Olympic cybersecurity planning efforts has been coordination and collaboration among a range of stakeholders, including the private sector.

Understanding Japan's cybersecurity threat landscape will help planners mitigate threats

  • The typology of threat actors revealed six types of actors with the potential to pose a risk to the Tokyo 2020 games: cyber criminals, insider threats, foreign intelligence services, hacktivists, cyberterrorists, and ticket scalpers.
  • Motivations vary with the type of actor, but a streamlined classification of profit, ideology, and revenge captures the motivations for most attacks.
  • Foreign intelligence services and other state-sponsored attackers rank at the top in terms of sophistication and level of risk to the games.
  • The risk analysis methods and threat actor typology developed for Tokyo 2020 offer a valuable basis for future research to support the cybersecurity goals of other high-profile international events.

Recommendations

  • Plan early to ensure ample time to assess event-specific threats, shape a community of stakeholders and build trust among them, and establish mechanisms and processes for information sharing, incident reporting, and problem resolution.
  • Cooperate and share information with all cybersecurity stakeholders, including the private sector, to effectively mitigate cybersecurity risks.
  • Ensure that all stakeholders understand the mission and work toward a common goal, bolstering trust and a commitment to information sharing.
  • Define stakeholder roles and responsibilities, and revisit them throughout the planning process, to help stakeholders understand how best to contribute and whom to contact when changes or incidents arise.
  • Allocate resources appropriately to reduce cybersecurity risks, prioritizing threat types and threat actors as needed to apportion these investments.
  • Deter the riskiest adversaries with a targeted cyber defense campaign. For example, a publicly documented cybersecurity exercise to showcase defensive preparations might deter attacks altogether or convince attackers that the costs of executing an attack are too high, the chances of success are too low, and the prospective retaliatory costs are unbearable.

Table of Contents

  • Chapter One

    Introduction

  • Chapter Two

    Policy Context

  • Chapter Three

    The Cybersecurity Threat Landscape in Japan

  • Chapter Four

    Lessons from Prior Olympic Games

  • Chapter Five

    A Risk Assessment of Japan's Cybersecurity Landscape

  • Chapter Six

    Conclusions and Policy Options

  • Appendix A

    Methods

  • Appendix B

    Interview Protocol

  • Appendix C

    JPCERT/CC Incident Categories

Research conducted by

This project is a RAND Venture. Funding was provided by gifts from RAND supporters and income from operations. The research was conducted by the Center for Asia Pacific Policy (CAPP) within RAND International Programs.

This report is part of the RAND Corporation Research report series. RAND reports present research findings and objective analysis that address the challenges facing the public and private sectors. All RAND reports undergo rigorous peer review to ensure high standards for research quality and objectivity.

This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited; linking directly to this product page is encouraged. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial purposes. For information on reprint and reuse permissions, please visit www.rand.org/pubs/permissions.

The RAND Corporation is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.