Institutional Innovation in Contested Territory: Quantified Cyber Security and Risk

Say you are an entrepreneurial sort of person who wants to really change the world of cyber security. Problem: nobody seems to know where the game-changing innovation is going to come from.  Is it technology?  Is it economics?  Is it law and policy? Is it sociology? Maybe combination, but what? And in what sequence?

If you aim for institutional innovation, then at some point you are going to need to take sides in the great "Quant vs. Non-quant" debate:

• Can cyber security and risk be quantified? 
• If "yes", how can quantitative information be used to realize security to significantly improve outcomes?

Whether you choose Quant or Non-quant, you will need some tools and methods to advance the state of the art.  But how do you know if you are choosing the right tools, and using them well?  (Think about the difference between Numerology and Calculus as they might be applied to physics of motion.)

Whoever makes sufficient progress toward workable solutions will "win", in the sense of getting wide-spread adoption, even if the other is "better" in some objective sense (i.e. "in the long run").

I examine this innovation race in a book chapter (draft). The book will probably come out in 2016.

Abstract:

"The focus of this chapter is on how the thoughts and actions of actors coevolve when they are actively engaged in institutional innovation. Specifically: How do innovators take meaningful action when they are relatively ‘blind’ regarding most feasible or desirable paths of innovation? Our thesis is that innovators use knowledge artifacts – e.g. dictionaries, taxonomies, conceptual frameworks, formal procedures, digital information systems, tools, instruments, etc. – as cognitive and social scaffolding to support iterative refinement and development of partially developed ideas. We will use the case of institutional innovation in cyber security as a way to explore these questions in some detail, including a computational model of innovation."

Your feedback, comments, and questions would be most welcome.

The computational model used is called "Percolation Models of Innovation".  Here is the NetLogo code of the model used in the book chapter.   Below are some figures from the book chapter.

Innovation as percolation. Progress moves from bottom to top. Each column is a "technology",
and neighboring columns are closely related.  This version (S&V 2005) only models
rate of progress and distribution of "sizes", not anything about the technology or
trajectory of innovation.

A screen shot of the user interface.  Three different models can be selected (upper left).

Here is a much more advanced/complicated version: NetLogo code V2 model (three models in one).  It is designed to model innovation with multiple types of knowledge (i.e. rival knowledge like Quant vs. Non-quant) and self-organizing innovation processes (i.e. concentrating resources in the most advanced technologies as they unfold).  Here is a screen shot from an early version:

Technologies (columns) have meaning. Each cell requires a certain mix of knowledge to "unlock":
"red knowledge" or "blue knowledge" or "none of the above" (green).  Otherwise, it's trial and error.
One agent starts at the bottom of each column, and is endowed with the mix of knowledge associated
 with that column. During a simulation run, agents  apply "R&D" in their neighborhood, and then
migrate up or right or left, depending on where progress is made.  In this run Red agents got stuck
about 1/3 way up, while Blue and Green agents joined forces for a breakthrough in the Green technologies.

I would have liked to use this model for the book chapter, but we ran into word count limits.  We would have needed half the chapter to explain the model, parameters, charts, displays, etc. and wouldn't have had space to do the results analysis.

Unfortunately, I haven't documented this model in the "Info" tab, so the book chapter is your best guide as to how the model works and what it means.  I'll come back later and edit this blog post with some tutorial information.