Information Security

Featured

Technology allows individuals and organizations access to more comprehensive and diverse information, but this access requires that electronic information, networks, data repositories, and data transmissions be adequately safeguarded. RAND has developed a large body of research focused on recognizing the potential threats to information security and data integrity, as well as implications for personal and institutional privacy.

  • Composite image of binary code on a sunset over water by Eileen Delson La Russo/RAND, adapted from images by Agil_Leonardo, Matejmo, and Byakkaya/Getty Images

    Report

    The Life and Times of Zero-Day Software Vulnerabilities

    Mar 9, 2017

    Zero-day software vulnerabilities—security holes that developers haven't fixed or aren't aware of—can lurk undetected for years. They are useful in cyber operations and in defensive and academic settings. Whether to disclose or stockpile them is an ongoing debate.

  • Woman using smartphone and laptop with icon graphic cyber security network of connected devices and personal data security, photo by oatawa/Getty Images

    Commentary

    How to Help Small Businesses Deal with Cyber Threats

    Sep 15, 2017

    Small businesses are especially vulnerable to cyber threats. What can be done to provide small businesses the security to continue to prosper, while enhancing America's cybersecurity workforce and making the economy more secure?

Explore Information Security

  • A flying police car hovers past city buildings

    Essay

    How Will Technology Change Criminal Justice?

    In perhaps no other field does society have as direct a stake in getting technology right as in policing. How will technology change the work that law enforcement agencies do and the communities they serve?

    Jan 7, 2016

  • Journal Article

    Cloud-Trust—a Security Assessment Model for Infrastructure as a Service (IaaS) Clouds

    The vulnerability of Cloud Computing Systems (CCSs) to Advanced Persistent Threats (APTs) is a significant concern to government and industry.

    Dec 23, 2015

  • A row of Iranian flags in front of the Tehran skyline

    Commentary

    Iran: A Rising Cyber Power?

    Iran is a country with revisionist tendencies that has accumulated enemies. This has impelled it to develop techniques to keep them at bay. Cyber, in some circumstances, is a particularly cost-effective way of doing so.

    Dec 16, 2015

  • Financial system representation

    Report

    The National Security Implications of Virtual Currency

    Could a non-state actor deploy a virtual currency to disrupt sovereignty and increase its political or economic power? How might a government or organization successfully disrupt such a deployment?

    Dec 16, 2015

  • Protesters from the online activist group Anonymous

    Commentary

    Anonymous vs. ISIS: Wishing the Vigilante Hackers Luck Against the Murderous Jihadists

    While ISIL uses the Internet to recruit fighters and incite violence, the Anonymous counter initiative could lower the volume of the online echo chamber, and yield support for the war against ISIL and its extremist ilk.

    Dec 14, 2015

  • Internet of Things graphic

    Commentary

    Keeping Hackers Away from Your Car, Fridge, and Front Door

    In the ever-growing Internet of Things, attackers already outpace the defenders. If developing solutions for software liability doesn't become more of a priority, there may be no winning this technological war.

    Dec 7, 2015

  • Close-up view on white conceptual keyboard - European Union (key with flag)

    Report

    Exploring Cybersecurity Threats and Policy Responses in the EU and Beyond

    Existing cybersecurity measures in the EU are fragmented, largely due to gaps in operational capabilities as well as strategic priorities of Member States. However, there are many policy options that may improve the EU's overall cybersecurity approach.

    Nov 18, 2015

  • A U.S. Air Force airman works at the 561st Network Operations Squadron, which executes defensive cyber operations

    Commentary

    The Two Sides of Cybersecurity

    Securing government networks is certainly necessary, but authorities should not lose sight of the need to couple their defense of America's networks with appropriate resources dedicated to combatting criminal, terrorist, and other threats in cyberspace.

    Nov 13, 2015

  • Journal Article

    Deterrence, Influence, Cyber Attack, and Cyberwar

    This study uses a simple model to speculate about whether deterrence can be a significant part of dealing with special features of the cyber attack challenge, and distinguishing different classes and contexts of cyber threats.

    Nov 13, 2015

  • Volkswagen CEO Matthias Mueller gives a tour of the VW factory in Wolfsburg, Germany, October 21, 2015

    Commentary

    When Public Trust in Corporations Is Shaken

    The Volkswagen scandal comes at a time when the public's trust in both the automotive industry and tech companies is at risk. The level of public trust in an individual organization could end up burnishing — or infecting — an entire industry or new technology.

    Oct 28, 2015

  • Research Brief

    Cybersecurity of Air Force Weapon Systems: Ensuring Cyber Mission Assurance Throughout a System's Life Cycle

    Discusses how the Air Force acquisition/life-cycle management community can improve cybersecurity throughout the life cycle of Air Force weapon systems.

    Oct 27, 2015

  • An F-15 flying over Nevada during a USAFWS Mission Employment Exercise

    Report

    Improving the Cybersecurity of U.S. Air Force Weapon Systems

    U.S. Air Force weapon systems containing information technology may be vulnerable to intelligence exploitation and cyberattacks. But there are steps that the Air Force can take to improve the security of these systems throughout their life cycles.

    Oct 27, 2015

  • Malware phishing data concept

    Commentary

    Social Engineering Explained: The Human Element in Cyberattacks

    The human element is the most unpredictable factor in cybersecurity. A social engineer aims to make people do what they want or give the social engineer information, often without the person considering the negative consequences.

    Oct 20, 2015

  • A person looking at top secret files with a magnifying glass

    Commentary

    Defining a New Paradigm for Government Secrecy

    Technology has afforded the U.S. national security apparatus incredible capabilities, along with equally monumental challenges and risks. The government has the option to choose whether to adjust by taking a proactive approach or to allow external forces to determine the future of its secrets.

    Oct 13, 2015

  • Congressional Briefing Podcast

    Multimedia

    United States and China: Trends in Military Competition

    In this October 2015 congressional briefing, Eric Heginbotham discusses relative U.S. and Chinese military capabilities, including the evolution of Chinese military capabilities, steps the United States can take to limit the impact of a growing Chinese military on deterrence, and other U.S. strategic interests.

    Oct 5, 2015

  • Joint service and civilian personnel concentrate on exercise scenarios during "Cyber Guard 2015."

    Testimony

    Perspective on 2015 DoD Cyber Strategy

    The DoD's cyber strategy is aligned with its mission, but there will be challenges to implementation—including building and maintaining a capable workforce, assessing risk across DoD networks and systems, and planning for operations.

    Sep 29, 2015

  • U.S. President Barack Obama and Chinese President Xi Jinping shake hands following a joint news conference in the Rose Garden at the White House in Washington September 25, 2015

    Commentary

    Define Acceptable Cyberspace Behavior

    While a U.S.-China cyberspace agreement is a welcome step, it also underscores the greater issues facing the United States and the international community in this largely ungoverned space. A precondition for securing U.S. networks should be the development of an overarching cyber doctrine that defines acceptable behavior and allows the U.S. to defend its networks against threats.

    Sep 27, 2015

  • Chinese President Xi Jinping visits Boeing in Everett, Washington, September 23, 2015

    Commentary

    The U.S.-China Summit Is More Significant for Xi Jinping Than Obama

    The Xi-Obama summit will provide the opportunity to discuss contentious issues like cybersecurity and the South China Sea, as well as other issues, such as climate change and economic cooperation. For Xi, the visit underscores the tremendous importance of messaging to a Chinese audience the narrative of a continued stable and robust partnership with the country that matters most to China politically and economically.

    Sep 24, 2015

  • Congressional Briefing Podcast

    Multimedia

    Lessons from a Hacker: Cyber Concepts for Policymakers

    In this September 14th congressional briefing, Lillian Ablon discusses the basics of cyber and information security and provides insights into some of the complexities of cybersecurity policymaking. Topics include why software vulnerabilities are significant, the components of cyber risk beyond the threat, motivations of various cyber threats actors, and what they exploit.

    Sep 14, 2015

  • News Release

    China's Military Modernization Increasingly Challenges U.S. Defense Capabilities in Asia

    Although China continues to lag behind the United States in terms of aggregate military hardware and operational skills, it has improved its capabilities relative to those of the U.S. in many critical areas. Moreover, China does not need to catch up fully in order to challenge U.S. ability to conduct effective military operations near the Chinese mainland.

    Sep 14, 2015