Chatham House

From the webpage: "Cyberspace is now established as an important domain of national and international security. Until recently, informed and open discussion on the responsible use of offensive cyber capabilities has been constrained by high levels of secrecy around national strategies for their use. Insights as to how individual states view the utility of offensive cyber, and how they perceive and manage associated risks of escalation and conflict, have been hard to access. A lack of open debate around the limitations of cyber operations has also led to inaccurate portrayals of cyber capabilities as versatile 'silver bullet' solutions which can address a widening variety of security challenges. This paper offers an in-depth exploration of new or revised national cyber strategies, authorization mechanisms and legislation in nine NATO states, and draws on interviews with national cyber experts. As well as aiming to promote more informed debate on the key issues, it presents important policy recommendations to support the responsible use of offensive cyber and to contribute to the achievement of a secure cyberspace for all."

Royal Institute Of International Affairs Skingsley, Charlotte . 2023. 37p.

By Steven Kemp, David Buil-Gil , Fernando Miró-Llinares and Nicholas Lord3

Although it is known that businesses report cybercrime to public authorities at a low rate, and this hinders prevention strategies, there is a lack of research on companies’ decisions to report cyber victimisation. This paper analyses the UK Cyber Security Breaches Survey to explore factors associated with cybercrime reporting by businesses. Results indicate that the type of cybercrime is relevant to the reporting decision, and that the likelihood of reporting increases when cybersecurity incidents generate negative impacts and when the company places high priority on cybersecurity. However, we find no association between having cybersecurity insurance and reporting. Finally, while having outsourced cybersecurity management is associated with reporting to anyone outside the organisation but not to public authorities, inhouse cybersecurity teams seem more inclined to report to public authorities. Findings are discussed in relation to the role of the private cybersecurity sector and the criminal justice system in combatting cybercrime.

Criminology and Criminal Justice, 2021.