A combination of cyber technological feasibility and economic viability drives many of the decisions related to cybersecurity by both the defenders and attackers. In this context, technological feasibility is defined as any cyber resiliency technology that has the potential to be developed, fielded, and operationally controlled. In the case of economic viability, the resources required to defend or attack must be available. We define resources in its broadest sense to include but not limited to the people, equipment, training, required funding, and asset value. On the defensive side, these technological and economic factors determine the cyber security and resiliency policies, procedures and technologies implemented to prevent and respond to cyber-attacks. On the offensive side, they not only determine the type of attack but also the effort expended to ensure its success. In short, these and other factors determine the asymmetric balance between the attackers and defenders.
The CRE25 Workshop on Cyber Resiliency: Technologies, Economics and Strategy will explore foundational and applied advances in cyber resiliency strategies, policies and technologies to shift the asymmetric balance in favor of the defender, and identify and quantify the effect economic realities have on the decision processes. At the top level, national and organizational strategies and policies are required to understand what is to be achieved and the resources to be made available. These strategies and policies must be support by security and resiliency technologies. As a result, in addition to exploring various strategies, the workshop will seek to understand the capabilities, strengths/weaknesses, and benefits of various resiliency technologies whether existing or in research. The workshop will examine the parameters needed to accurately quantify asymmetric imbalance from both the offensive and defensive perspective; examine technical and non-technical approaches to shifting that balance, including the full range of costs/benefits of each approach; and explore and evaluate a range of options for defining and achieving optimality. It will bring together a diverse group of experts from multiple fields to advance the above concepts. This will serve to accelerate the recognition, adoption and application of cyber resilience within industry, government and academia by addressing the key concerns of how these techniques and technologies can be realized within the practical constraints of cost, risk, and benefit.
The list of topics includes, but is not limited to:
Cyber resiliency is applicable to any system/component that can fail or be attacked. As a result, this workshop is interested in the above topics as they relate across the entire software stack for both Information Technology (IT) and Operational Technology (OT).
Authors are invited to submit original unpublished research papers as well as industrial practice papers. Simultaneous submissions to other conferences are not permitted. Detailed instructions for electronic paper submission, panel proposals, and review process can be found at QRS submission.
Each submission can have a maximum of ten pages. It should include a title, the name and affiliation of each author, a 300-word abstract, and up to 6 keywords. Shorter version papers (up to six pages) are also allowed.
All papers must conform to the QRS conference proceedings format (PDF | Word DOCX | Latex) and Submission Guideline set in advance by QRS 2025. At least one of the authors of each accepted paper is required to pay the full registration fee and present the paper at the workshop. Submissions must be in PDF format and uploaded to the conference submission site. Arrangements are being made to publish extended version of top-quality papers in selected SCI journals.
Submission| Name | Affiliation |
|---|---|
| Christopher Oehmen | Pacific Northwest National Laboratory |
| Rosalie McQuaid | MITRE |
| Name | Affiliation |
|---|---|
| Michael Atighetchi | Raytheon Corp, BBN |
| Octavian Carare | Federal Communications Commission |
| Peter Chen | Carnegie Mellon University/SEI |
| Yung Ryn Choe | Sandia National Laboratory |
| Herve Debar | Telecom SudParis |
| Sabrina De Capitani di Vimercati | Universita degli Studi di Milano |
| Anurag Dwivedi | John Hopkins University APL |
| Meghan Galiardi | Sandia National Laboratory |
| Arlette Hart | Leidos |
| Chad Heitzenrater | Air Force Research Laboratory |
| Craig Jackson | Indiana University |
| Doug Jacobson | Iowa State University |
| Volkmar Lotz | SAP |
| Luigi Mancini | Universita di Roma Sapienza |
| Al Mok | University of Texas at Austin |
| Luis Munoz-Gonzalez | Imperial University |
| Takashi Nanya | University of Tokyo |
| Nuno Neves | University of Lisbon |
| Mohammad Rahman | Florida International University |
| Indrajit Ray | Colorado State University |
| Craig Rieger | Idaho National Laboratory |
| Luigi Romano | University of Naples |
| O. Sami Saydjari | Cyber Defense Agency |
| Nabil Schear | MIT Lincoln Laboratory |
| Neeraj Suri | Technical University Darmstadt |
| Reginald Sawilla | Government of Canada |
| Marco Vieira | University of Coimbra |
| Eric Vugrin | Sandia National Laboratory |
| Chris Walter | WW Technology Group |
| Ian Welch | Victoria University of Wellington |
