Cyber Risk Management for Critical Infrastructure: A Risk Analysis Model and Three Case Studies

Abstract

Managing cyber security in an organization involves allocating the protection budget across a spectrum of possible options. This requires assessing the benefits and the costs of these options. The risk analyses presented here are statistical when relevant data are available, and system-based for high-consequence events that have not happened yet. This article presents, first, a general probabilistic risk analysis framework for cyber security in an organization to be specified. It then describes three examples of forward-looking analyses motivated by recent cyber attacks. The first one is the statistical analysis of an actual database, extended at the upper end of the loss distribution by a Bayesian analysis of possible, high-consequence attack scenarios that may happen in the future. The second is a systems analysis of cyber risks for a smart, connected electric grid, showing that there is an optimal level of connectivity. The third is an analysis of sequential decisions to upgrade the software of an existing cyber security system or to adopt a new one to stay ahead of adversaries trying to find their way in. The results are distributions of losses to cyber attacks, with and without some considered countermeasures in support of risk management decisions based both on past data and anticipated incidents.

Integrating a Proactive Technique Into a Holistic Cyber Risk Management Approach

“…In this regard, the usage of data collection and analysis related to the attacker may be essential to decision making. For example, such analysis may determine whether it is necessary to update the software of an existing cybersecurity system or to adopt a new one to stay ahead of cyber attackers trying to compromise a system (Paté-Cornell et al, 2017). Thus, proactive data gathering and analysis of attackers can help achieve both short-and long-term cyber risk management goals.…”

Security of Separated Data in Cloud Systems with Competing Attack Detection and Data Theft Processes

“…The suggested model allows the user to choose the optimal data partition and protection policy, an important task of cyber risk management (Paté‐Cornell, Kuypers, Smith, & Keller, ). In many cases cloud providers suggest to users several different options for data protection and attack detection (types of EWAs) at different price.…”

A Data-Driven Approach to Cyber Risk Assessment

“…Reliable models for the measure of the cyber risk are not available or have signi cant limitations, like the lack of generalization and the fact that most works consider only the analysis of past data to derive probabilistic models, while it is not clear how to obtain reliable estimates about future events [7,8]. Moreover, some quantitative approaches, like the well-known HTMA (how to measure anything) [9] and the FAIR [10] methods rely on a subjective evaluation of the likelihood of an event (in particular, of the probability of a successful attack due to a certain threat) given by a team of experts [11,12]. ese kinds of probabilities usually show some level of inaccuracy and should be replaced by more objective models.…”