Cyber Risk Assessment and Optimization: A Small Business Case Study
Assessing and controlling cyber risk is the cornerstone of information security management, but also a formidable challenge for organisations due to the uncertainties associated with attacks, the resulting risk exposure, and the availability of scarce resources for investment in mitigation measures....
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2023-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/10114920/ |
| _version_ | 1797829142376349696 |
|---|---|
| author | Maria Tsiodra Sakshyam Panda Michail Chronopoulos Emmanouil Panaousis |
| author_facet | Maria Tsiodra Sakshyam Panda Michail Chronopoulos Emmanouil Panaousis |
| author_sort | Maria Tsiodra |
| collection | DOAJ |
| description | Assessing and controlling cyber risk is the cornerstone of information security management, but also a formidable challenge for organisations due to the uncertainties associated with attacks, the resulting risk exposure, and the availability of scarce resources for investment in mitigation measures. In this paper, we propose a cybersecurity decision-support framework, called CENSOR, for optimal cyber security investment. CENSOR accounts for the serial nature of a cyber attack, the uncertainty in the time required to exploit a vulnerability, and the optimisation of mitigation measures in the presence of a limited budget. First, we evaluate the cost that an organisation incurs due to a cyber security breach that progresses in stages and derive an analytical expression for the distribution of the present value of the cost. Second, we adopt a Set Covering and a Knapsack formulation to derive and compare optimal strategies for investment in mitigation measures. Third, we validate CENSOR via a case study of a small business (SB) based on: (i) the 2020 Common Weakness Enumeration (CWE) top 25 most dangerous software weaknesses; and (ii) the Center for Internet Security (CIS) Controls. Specifically, we demonstrate how the Knapsack formulation provides solutions that are both more affordable and entail lower risk compared to those of the Set Covering formulation. Interestingly, our results confirm that investing more in cybersecurity does not necessarily lead to an analogous cyber risk reduction, which indicates that the latter decelerates beyond a certain point of security investment intensity. |
| first_indexed | 2024-04-09T13:15:42Z |
| format | Article |
| id | doaj.art-7d9a52dc61a24e49901fa7382da1e0d3 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-04-09T13:15:42Z |
| publishDate | 2023-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-7d9a52dc61a24e49901fa7382da1e0d32023-05-11T23:00:52ZengIEEEIEEE Access2169-35362023-01-0111444674448110.1109/ACCESS.2023.327267010114920Cyber Risk Assessment and Optimization: A Small Business Case StudyMaria Tsiodra0https://orcid.org/0009-0008-2506-4146Sakshyam Panda1https://orcid.org/0000-0001-7274-0073Michail Chronopoulos2https://orcid.org/0000-0002-3858-2021Emmanouil Panaousis3https://orcid.org/0000-0001-7306-4062Business Intelligence, The Open University, Milton Keynes, U.K.Faculty of Engineering and Science, University of Greenwich, London, U.K.Bayes Business School, City, University of London, London, U.K.Faculty of Engineering and Science, University of Greenwich, London, U.K.Assessing and controlling cyber risk is the cornerstone of information security management, but also a formidable challenge for organisations due to the uncertainties associated with attacks, the resulting risk exposure, and the availability of scarce resources for investment in mitigation measures. In this paper, we propose a cybersecurity decision-support framework, called CENSOR, for optimal cyber security investment. CENSOR accounts for the serial nature of a cyber attack, the uncertainty in the time required to exploit a vulnerability, and the optimisation of mitigation measures in the presence of a limited budget. First, we evaluate the cost that an organisation incurs due to a cyber security breach that progresses in stages and derive an analytical expression for the distribution of the present value of the cost. Second, we adopt a Set Covering and a Knapsack formulation to derive and compare optimal strategies for investment in mitigation measures. Third, we validate CENSOR via a case study of a small business (SB) based on: (i) the 2020 Common Weakness Enumeration (CWE) top 25 most dangerous software weaknesses; and (ii) the Center for Internet Security (CIS) Controls. Specifically, we demonstrate how the Knapsack formulation provides solutions that are both more affordable and entail lower risk compared to those of the Set Covering formulation. Interestingly, our results confirm that investing more in cybersecurity does not necessarily lead to an analogous cyber risk reduction, which indicates that the latter decelerates beyond a certain point of security investment intensity.https://ieeexplore.ieee.org/document/10114920/Cybersecurityoperational researchset coveringknapsacksoftware weaknessescontrol optimisation |
| spellingShingle | Maria Tsiodra Sakshyam Panda Michail Chronopoulos Emmanouil Panaousis Cyber Risk Assessment and Optimization: A Small Business Case Study IEEE Access Cybersecurity operational research set covering knapsack software weaknesses control optimisation |
| title | Cyber Risk Assessment and Optimization: A Small Business Case Study |
| title_full | Cyber Risk Assessment and Optimization: A Small Business Case Study |
| title_fullStr | Cyber Risk Assessment and Optimization: A Small Business Case Study |
| title_full_unstemmed | Cyber Risk Assessment and Optimization: A Small Business Case Study |
| title_short | Cyber Risk Assessment and Optimization: A Small Business Case Study |
| title_sort | cyber risk assessment and optimization a small business case study |
| topic | Cybersecurity operational research set covering knapsack software weaknesses control optimisation |
| url | https://ieeexplore.ieee.org/document/10114920/ |
| work_keys_str_mv | AT mariatsiodra cyberriskassessmentandoptimizationasmallbusinesscasestudy AT sakshyampanda cyberriskassessmentandoptimizationasmallbusinesscasestudy AT michailchronopoulos cyberriskassessmentandoptimizationasmallbusinesscasestudy AT emmanouilpanaousis cyberriskassessmentandoptimizationasmallbusinesscasestudy |