Automated Cyber and Privacy Risk Management Toolkit

Abstract

Addressing cyber and privacy risks has never been more critical for organisations. While a number of risk assessment methodologies and software tools are available, it is most often the case that one must, at least, integrate them into a holistic approach that combines several appropriate risk sources as input to risk mitigation tools. In addition, cyber risk assessment primarily investigates cyber risks as the consequence of vulnerabilities and threats that threaten assets of the investigated infrastructure. In fact, cyber risk assessment is decoupled from privacy impact assessment, which aims to detect privacy-specific threats and assess the degree of compliance with data protection legislation. Furthermore, a Privacy Impact Assessment (PIA) is conducted in a proactive manner during the design phase of a system, combining processing activities and their inter-dependencies with assets, vulnerabilities, real-time threats and Personally Identifiable Information (PII) that may occur during the dynamic life-cycle of systems. In this paper, we propose a cyber and privacy risk management toolkit, called AMBIENT (Automated Cyber and Privacy Risk Management Toolkit) that addresses the above challenges by implementing and integrating three distinct software tools. AMBIENT not only assesses cyber and privacy risks in a thorough and automated manner but it also offers decision-support capabilities, to recommend optimal safeguards using the well-known repository of the Center for Internet Security (CIS) Controls. To the best of our knowledge, AMBIENT is the first toolkit in the academic literature that brings together the aforementioned capabilities. To demonstrate its use, we have created a case scenario based on information about cyber attacks we have received from a healthcare organisation, as a reference sector that faces critical cyber and privacy threats.

A Trusted Platform Module-based, Pre-emptive and Dynamic Asset Discovery Tool

“…Moreover, the information discovered by ISADT can be used by other tools and methodologies, like the one presented in [21], to predict future incidents and identify new threat patterns in each single asset. This information can also be used to detect the cyber-security and the privacy risks in a device before an information exchange is done, as presented in [22].…”

Exploration of Mobile Device Behavior for Mitigating Advanced Persistent Threats (APT): A Systematic Literature Review and Conceptual Framework

“…This section presents a general overview of risk management approaches against cyber-attacks. This study identified 23 primary studies, of which two focused on mobile [153,154], six focused on IoT devices [107,[155][156][157][158]181], two focused on cyber-physical systems [168,169], four focused on either fog computing [111,160], the 5G edge-cloud ecosystem [167], or connected and autonomous vehicle (CAV) [159], and eight in general [61,93,[161][162][163][164][165][166]. Furthermore, four primary studies focused on APT [93,107,111,160], while the others are focused on either specific attacks such as DDOS attacks [181], DOS [167], SQL injections attacks [181], or privilege-induced attacks [154], or non-specific attacks [60,61,140,[155][156][157][158][159][161][162][163][164][165][166]…”

“…This ever-changing threat landscape leads to a lack of a clear and comprehensive understanding of the TTP of APTs [23]. Other solutions proposed risk management approaches that focused on APTs [93,132,146] or traditional attacks [93,111,[161][162][163][164][165][166][167][168][169][170]. Most of the existing studies have focused on qualitative approaches due to their simplicity, risk appetite, and ability to evaluate risk.…”

Mission‐centric decision support in cybersecurity via Bayesian Privilege Attack Graph

“…Recently, Murenin et al 55 provided an overview and comparison of the most prominent systems and approaches to design decision‐making systems and their application in heterogeneous distributed information systems, although with very wide conclusions. Emerging issues in this domain seem to be privacy risk management 56 and the use of distributed ledger technologies (e.g., blockchain) that would enable privacy‐preserving countermeasure selection 57…”