go to 9/12 home page

In this final week of the Module, participants will explore how non-technical cyber security considerations form the foundation of national and international policy solutions. Cyber security and cyber resilience cannot be achieved by technical means alone. As weeks 1, 2 and 3 of this Module have shown, there are political, economic, social, legal and increasingly environmental considerations to take into account in addition to the technical (the PESTLE approach to cyber security). Effective policy must, if possible, draw together these elements as they are each important parts of wider solutions. 

In this unit, students will explore what makes effective policy in the cyber context when dealing with major cyber incidents targeting critical national infrastructure. Crucial to this is the ability to combine and address different thematic areas and create succinct policy recommendations that still achieve particular goals and make states resilient to cyber incidents. 

go to 9/12 home page

In this unit students will be introduced to one of the most complex areas of cyber security: its relationship with international law, specifically the International Laws of Armed Conflict and International Humanitarian Law. 

Many major cyber incidents, such as Stuxnet, do not explicitly, categorically or obviously breach international law. Making a case is problematic and requires careful consideration and argument. In this unit, students will receive an introduction to international law, how it can be applied to major cyber incidents, and what states can do should they experience one.  

In all of the above, the key skill participants will gain is arguing for and making a case for a particular view, even when there is no clear-cut right or wrong answer. The key skill is creating and presenting a particular case to decision-makers. 

One of the critical areas to be covered in this section is the complex relationship between reserved and devolved responsibilities when responding to cyber incidents. While these policy areas are clearly separated between the UK Government (which retains cyber security policy) and the Scottish Government (which is concerned about the impact of a cyber incident on Scotland and its people), the nature of cyber incidents is such that the distinction between devolved and reserved areas is blurred. How policy- and decision-makers navigate these complexities is increasingly important in today’s digitalized world. 

go to 9/12 home page

In this unit, participants will explore how cyber operations and incidents can impact how states interact with one another. Major incidents such as Stuxnet have important geopolitical and geostrategic implications and can change the way states deal with one another. 

To understand how cyber operations fit into this complex landscape, participants will first be introduced to the foundations of the field of International Relations. Participants will explore some of the key theories of the field and what they mean, and also examine how “cyber” is changing those theories. The goal is to look beyond purely technical consequences of major cyber incidents and to explore how an incident identified in one part of the world can send political ripples all around the globe. 

Finally, participants will look at how private companies engage in international powerplay and what impact this has on international relations and strategy. 

By the end of Week 2, students will have:

1. Examined the international impacts and consequences of major cyber incidents, using Stuxnet as an example.
2. Explored the concepts and theories of the field of “international relations”.
3. Placed cyber incidents in that international context, with the understanding that technological events can have non-technological consequences beyond their immediate vicinity.
4. Explained and discussed the international implications of cyber incidents to a non-technical or non-IR-expert group of policy-makers.

go to 9/12 home page

In this unit, module participants will delve into the intricate technical dimensions of Stuxnet, an unprecedented cyber weapon, in order to be able to clearly explain technical cyber issues to a non-technical audience of decisionmakers. Exploring its architecture, students will dissect Stuxnet’s code, uncovering advanced techniques like code injection and zero-day exploits.  

Through videos and real-life technical analyses of a major cyber incident, learners will grasp the malware’s propagation methods and its tailored attack on industrial systems, particularly Iran’s nuclear facilities. Discussions should revolve around Stuxnet’s implications for global cybersecurity, emphasizing the significance of understanding such sophisticated threats. By immersing themselves in Stuxnet’s technical intricacies, students will gain insights into the evolving landscape of cyber warfare and the importance of robust defense strategies, while also gaining and practicing key discussion skills.