معرفی
Sasha Romanosky is a Senior Policy Researcher at RAND Corporation specializing in the economics of cyber security, privacy, insurance, cybercrime, and national security. His work spans policy analysis, risk assessment, and cybersecurity frameworks with significant contributions to industry standards like CVSS and EPSS.
Dr. Romanosky's educational background includes:
- Ph.D. in Public Policy and Management from Carnegie Mellon University
- B.S. in Electrical Engineering from the University of Calgary, Canada
Romanosky's research focuses on the intersection of cybersecurity economics and policy. His work examines how insurance companies price cyber risk, the cost of data breaches to organizations, and whether corporate losses are as severe as commonly believed. He has developed methodologies to identify, collect, and apply regression and NLP analyses to federal civil and criminal cases related to cybersecurity.
His research also extends to software supply chain security, which he identifies as a leading risk due to the fragmented nature of modern software development. Romanosky has contributed to understanding cyber collateral damage, vulnerability equities processes, and the integration of cyber risk into enterprise risk management frameworks.
Romanosky's publications reveal a strong focus on practical applications of cybersecurity research with emphasis on risk assessment, insurance mechanisms, and policy implications. His work bridges technical cybersecurity issues with economic and legal considerations, providing valuable insights for both private sector organizations and government entities.
Notable contributions include:
- Coauthor of the Common Vulnerability Scoring System (CVSS)
- Coauthor of the Exploit Prediction Scoring System (EPSS)
Throughout his career, Romanosky has advised government agencies including the Department of Defense and the Department of Homeland Security. His previous roles include being a research fellow at NYU's Information Law Institute, a member of DHS's Data Privacy and Integrity Advisory Committee, and a cyber policy advisor at the Pentagon.
Romanosky leads research initiatives focused on understanding cyber risk dependencies, developing frameworks for vulnerability management, and analyzing the effectiveness of cybersecurity practices across public and private sectors.
