Cybersecurity for Essential Services: Towards a Value-Based Approach

This paper argues that current cybersecurity theories are inadequate for protecting essential services. Existing approaches emphasize asset protection and infrastructure resilience, often overlooking the societal value of services and the complex, interdependent systems that sustain them. Rooted in computer security traditions, these models rarely account for the broader political, economic, and social consequences of service disruptions. We propose a value-informed theory of cybersecurity that centers on the services delivered, the users affected, and the dynamic relationships among actors. Based on interdisciplinary insights and real-world cases, we identify critical limitations in prevailing frameworks. We outline three key propositions: (1) cybersecurity should reflect the interests of all stakeholders in service provision; (2) it must assess value loss across societal, organizational, and individual levels; and (3) it should capture the interdependencies that shape service delivery ecosystems. This approach shifts the focus from protecting assets to sustaining essential services and the public value they create.