Cyber Trust Index: A Framework for Rating and Improving Cybersecurity Performance
Cybersecurity risk is among the top risks that every organization must consider and manage, especially during this time wherein technology has become an integral part of our lives; however, there is no efficient and simplified measurement method that organizations or regulators could use, as frequen...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-11-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/12/21/11174 |
| _version_ | 1827647329014906880 |
|---|---|
| author | Sasawat Malaivongs Supaporn Kiattisin Pattanaporn Chatjuthamard |
| author_facet | Sasawat Malaivongs Supaporn Kiattisin Pattanaporn Chatjuthamard |
| author_sort | Sasawat Malaivongs |
| collection | DOAJ |
| description | Cybersecurity risk is among the top risks that every organization must consider and manage, especially during this time wherein technology has become an integral part of our lives; however, there is no efficient and simplified measurement method that organizations or regulators could use, as frequently as they need, to evaluate and compare the outcome of cybersecurity efforts that have been put in place. Consequently, this has resulted in an absence of critical data for cybersecurity improvement. This research proposes a Cyber Trust Index (CTI), a novel and simplified framework for evaluating, benchmarking, and improving organizations’ cybersecurity performance. <b>Methods</b>: The researchers analyzed prominent scientific research papers and widely used security standards to develop baseline security controls that serve as a measurement foundation. Then, they identified Control Enablers and Capability Tiers that were used as base measures and measurement methods. The CTI framework was evaluated by experts and tested with 35 organizations from the critical information infrastructure (CII) sector, as well as other generic sectors, in Thailand to confirm its validity and reliability in real organization settings and identify the priorities and factors that can contribute to better cybersecurity performance. <b>Results</b>: The CTI has two key elements: the baseline controls and rating methods. The baseline controls comprise 12 dimensions, 25 clusters, and 70 controls. The rating methods utilize five control enablers and five capability tiers to compute scores. A binary questionnaire is used to capture data for the rating process. Based on a statistical analysis of CTI results from 35 pilot organizations, 28.57% are in the beginner group with high-risk exposure, 31.43% are in the leader group with low-risk exposure, and 40% of organizations are in between (the intermediate and advanced groups). Two key factors distinguish between the beginner and leader groups: (1) an internal factor, which is the Control Enablers; and (2) an external factor, which is the influence of a cyber regulating body. Our study confirms that Control Enablers in higher Tiers will help organizations achieve better cybersecurity performance (R = 0.98021) and highlights the significance of cyber regulating bodies by showing a shear difference of 197.53% in cyber performance between highly regulated and low-regulated industries. <b>Conclusions</b>: This research reveals key insights into the importance of Control Enablers, which are the internal factors that organizations must leverage to drive better cybersecurity performance, and the positive return on enforcement, which emphasizes the need for cyber regulating bodies. The CTI framework has proven to be valid and efficient for measuring cybersecurity performance. At the very least, a step-wise roadmap is provided for organizations and regulators to adopt and adapt the CTI framework for their cybersecurity measurement and improvement mission. |
| first_indexed | 2024-03-09T19:17:36Z |
| format | Article |
| id | doaj.art-ec54236ca68e4f61861b49dfe5a8a51c |
| institution | Directory Open Access Journal |
| issn | 2076-3417 |
| language | English |
| last_indexed | 2024-03-09T19:17:36Z |
| publishDate | 2022-11-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Applied Sciences |
| spelling | doaj.art-ec54236ca68e4f61861b49dfe5a8a51c2023-11-24T03:39:15ZengMDPI AGApplied Sciences2076-34172022-11-0112211117410.3390/app122111174Cyber Trust Index: A Framework for Rating and Improving Cybersecurity PerformanceSasawat Malaivongs0Supaporn Kiattisin1Pattanaporn Chatjuthamard2Faculty of Engineering, Mahidol University, Salaya 73170, ThailandFaculty of Engineering, Mahidol University, Salaya 73170, ThailandCenter of Excellence in Management Research for Corporate Governance and Behavioral, Sasin School of Management, Chulalongkorn University, Bangkok 10330, ThailandCybersecurity risk is among the top risks that every organization must consider and manage, especially during this time wherein technology has become an integral part of our lives; however, there is no efficient and simplified measurement method that organizations or regulators could use, as frequently as they need, to evaluate and compare the outcome of cybersecurity efforts that have been put in place. Consequently, this has resulted in an absence of critical data for cybersecurity improvement. This research proposes a Cyber Trust Index (CTI), a novel and simplified framework for evaluating, benchmarking, and improving organizations’ cybersecurity performance. <b>Methods</b>: The researchers analyzed prominent scientific research papers and widely used security standards to develop baseline security controls that serve as a measurement foundation. Then, they identified Control Enablers and Capability Tiers that were used as base measures and measurement methods. The CTI framework was evaluated by experts and tested with 35 organizations from the critical information infrastructure (CII) sector, as well as other generic sectors, in Thailand to confirm its validity and reliability in real organization settings and identify the priorities and factors that can contribute to better cybersecurity performance. <b>Results</b>: The CTI has two key elements: the baseline controls and rating methods. The baseline controls comprise 12 dimensions, 25 clusters, and 70 controls. The rating methods utilize five control enablers and five capability tiers to compute scores. A binary questionnaire is used to capture data for the rating process. Based on a statistical analysis of CTI results from 35 pilot organizations, 28.57% are in the beginner group with high-risk exposure, 31.43% are in the leader group with low-risk exposure, and 40% of organizations are in between (the intermediate and advanced groups). Two key factors distinguish between the beginner and leader groups: (1) an internal factor, which is the Control Enablers; and (2) an external factor, which is the influence of a cyber regulating body. Our study confirms that Control Enablers in higher Tiers will help organizations achieve better cybersecurity performance (R = 0.98021) and highlights the significance of cyber regulating bodies by showing a shear difference of 197.53% in cyber performance between highly regulated and low-regulated industries. <b>Conclusions</b>: This research reveals key insights into the importance of Control Enablers, which are the internal factors that organizations must leverage to drive better cybersecurity performance, and the positive return on enforcement, which emphasizes the need for cyber regulating bodies. The CTI framework has proven to be valid and efficient for measuring cybersecurity performance. At the very least, a step-wise roadmap is provided for organizations and regulators to adopt and adapt the CTI framework for their cybersecurity measurement and improvement mission.https://www.mdpi.com/2076-3417/12/21/11174cybersecurity ratingcyber trust indexcybersecurity performance measurementcontrol enablercyber resilience |
| spellingShingle | Sasawat Malaivongs Supaporn Kiattisin Pattanaporn Chatjuthamard Cyber Trust Index: A Framework for Rating and Improving Cybersecurity Performance Applied Sciences cybersecurity rating cyber trust index cybersecurity performance measurement control enabler cyber resilience |
| title | Cyber Trust Index: A Framework for Rating and Improving Cybersecurity Performance |
| title_full | Cyber Trust Index: A Framework for Rating and Improving Cybersecurity Performance |
| title_fullStr | Cyber Trust Index: A Framework for Rating and Improving Cybersecurity Performance |
| title_full_unstemmed | Cyber Trust Index: A Framework for Rating and Improving Cybersecurity Performance |
| title_short | Cyber Trust Index: A Framework for Rating and Improving Cybersecurity Performance |
| title_sort | cyber trust index a framework for rating and improving cybersecurity performance |
| topic | cybersecurity rating cyber trust index cybersecurity performance measurement control enabler cyber resilience |
| url | https://www.mdpi.com/2076-3417/12/21/11174 |
| work_keys_str_mv | AT sasawatmalaivongs cybertrustindexaframeworkforratingandimprovingcybersecurityperformance AT supapornkiattisin cybertrustindexaframeworkforratingandimprovingcybersecurityperformance AT pattanapornchatjuthamard cybertrustindexaframeworkforratingandimprovingcybersecurityperformance |