Cyber risk quantification

Add links
From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Citation bot (talk | contribs) at 23:49, 16 October 2022 (Add: s2cid, date. | Use this bot. Report bugs. | Suggested by Whoop whoop pull up | Category:Computer security | #UCB_Category 23/194). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Cyber risk quantification involves the application of risk quantification techniques to an organization's cybersecurity risk. Cyber risk quantification is the process of evaluating the cyber risks that have been identified and then validating, measuring and analyzing the available cyber data using mathematical modeling techniques to accurately represent the organization's cybersecurity environment in a manner that can be used to make informed cybersecurity infrastructure investment and risk transfer decisions. Cyber risk quantification is a supporting activity to cybersecurity risk management; cybersecurity risk management is a component of enterprise risk management and is especially important in organizations and enterprises that are highly dependent upon their information technology (IT) networks and systems for their business operations.

One method of quantifying cyber risk is the value-at-risk (VaR) method that is discussed at the January 2015 World Economic Forum meeting.[1] At this meeting, VaR was studied and researched and deemed to be a viable method of quantifying cyber risk.

A well known framework for cyber risk quantification is called FAIRTM (Factor Analysis of Information Risk). The FAIR Institute is a non-profit professional organization committed to furthering the science of cyber and operational risk measurement and management. [2][3][4][5]

Cyber-Risk Quantification can be an automated or software supported process allowing Users to construct mathematical models to quantify Cyber-Security risks. Cyber risk quantification has gotten increased attention in 2022 with Forrester research analysts beginning to cover the space. Their recent report, The Emerging Cyber Risk Quantification Market: When CISOs Need Decisions, Not More Dashboards[6] highlights the FAIR Model, as well as new entrants in the space who are taking different approaches. One such vendor is Axio Global, which raised $23M to help companies quantify cyber risk.[7]

Practical Implementations

Cyber risk quantification has been used in a variety of practical applications, including:

  1. Cyber insurance [8]
  2. Cyber Security Return on Investment [9][10][11]
  3. Software Mitigation Costs [12]

Mathematical definition

The mathematical definition of Cyber-Risk is as follows:

  • Cyber-Risk = 1 - Cyber-Confidence

'Cyber-Confidence' is / are the actual executed tests which have passed. This value can be converted to a statistical probability & the associated Cyber-Risk calculated:

  • Example-1: 'A certain number' of tests have been executed & passed. Let's imagine that it yields a Defect-Free Confidence of 97.43%. Answer: Cyber-Risk = 2.57%.
  • Example-2: All 65,536 TCP ports & 65,536 UDP ports are confirmed to be dead or inactive on an asset; how resistant to penetration is it ? Answer: Cyber-Confidence = 99.83%, Cyber-Risk = 0.17%

Typically, this form of Cyber-Confidence &/or Cyber-Risk estimation is termed Testimation because:

  • It can be applied to estimate the number of tests required for any desired level of Cyber-Confidence
  • It can be applied to estimate the Cyber-Confidence (& Cyber-Risk) based upon the number of tests which have actually been executed & passed

See also

References

  1. ^ "New Framework to Help Companies Calculate Risk of Cyberattacks". Archived from the original on September 28, 2016.
  2. ^ "The Fair Institute".
  3. ^ "A Methodology for Cyberthreat Ranking: Incorporating the NIST Cybersecurity Framework into FAIR Model". ProQuest. Archived from the original on October 26, 2021.
  4. ^ "Inaugural combined FAIR Institute/ISACA Sydney Chapter virtual meeting".
  5. ^ "Using FAIR and NIST CSF for Security Risk Management".
  6. ^ "The Emerging Cyber Risk Quantification Market: When CISOs Need Decisions, Not More Dashboards". January 31, 2022.
  7. ^ "Axio lands $23M to help companies quantify cyber risk". August 4, 2022.
  8. ^ Orlando, Albina (2021). "Cyber Risk Quantification: Investigating the Role of Cyber Value at Risk". Risks. 9 (10): 184. doi:10.3390/risks9100184.
  9. ^ Alsaleh, Mohammed Noraden; Husari, Ghaith; Al-Shaer, Ehab (2016). "Optimizing the RoI of cyber risk mitigation". 2016 12th International Conference on Network and Service Management (CNSM): 223–227. doi:10.1109/CNSM.2016.7818421. S2CID 16037703.
  10. ^ Alsaleh, Mohammed Noraden; Al-Shaer, Ehab; Husari, Ghaith (2017). "ROI-Driven Cyber Risk Mitigation Using Host Compliance and Network Configuration". Journal of Network and Systems Management. 25 (4): 759–783. doi:10.1007/s10922-017-9428-x. S2CID 20994581.
  11. ^ Radanliev, Petar; De Roure, David Charles; Nicolescu, Razvan; Huth, Michael; Montalvo, Rafael Mantilla; Cannady, Stacy; Burnap, Peter (2018). "Future developments in cyber risk assessment for the internet of things". Computers in Industry. 102: 14–22. arXiv:1809.05229. doi:10.1016/j.compind.2018.08.002. S2CID 52086955.{{cite journal}}: CS1 maint: url-status (link)
  12. ^ De Corniere, Alexandre; Taylor, Greg (August 2021). "A Model of Information Security and Competition". SSRN 3928754. Archived from the original on October 26, 2021.

External links

Retrieved from "https://en.wikipedia.org/w/index.php?title=Cyber_risk_quantification&oldid=1116512840"