“So if Mr Blue Head here clicks the link...” Risk Thinking in Cyber Security Decision Making

Abstract

Cyber security decision making is inherently complicated, with nearly every decision having knock-on consequences for an organisation’s vulnerability and exposure. This is further compounded by the fact that decision-making actors are rarely security experts and may have an incomplete understanding of the security that the organisation currently has in place. They must contend with a multitude of possible security options that they may only partially understand. This challenge is met by decision makers’ risk thinking —their strategies for identifying risks, assessing their severity, and prioritising responses. We study the risk thinking strategies employed by teams of participants in an existing dataset derived from a tabletop cyber-physical systems security game. Our analysis identifies four structural patterns of risk thinking and two reasoning strategies: risk-first and opportunity-first . Our work highlights that risk-first approaches (as prescribed by the likes of NIST-800-53 and ISO 27001) are followed neither substantially nor exclusively when it comes to decision making. Instead, our analysis finds that decision making is affected by the plasticity of teams—that is, the ability to readily switch between ideas and practising both risk-first and opportunity-first reasoning.

When the future meets the past: Can safety and cyber security coexist in modern critical infrastructures?

“…Risk management: Between calculation and anticipation. Understanding risk management in critical infrastructures is a multifaceted issue of both qualitative and quantitative nature (Shreeve et al 2020). Despite the rise of rule-based and probabilistic risk methodologies, for example, attack trees, attribute-based algorithms (Tatam et al, 2021), security risk is 'incalculable' since there are limits of what could be inferred from scientific data (Amoore, 2014: 424).…”

“…Previous risk studies embedded in the critical infrastructure context highlighted that risk assessments are collaborative processes, rather than a matter of following a formal methodology (Frey et al, 2019;Shreeve et al, 2020). In doing so, they challenge the trope of 'security expertise' being solely a technical and individual matter.…”

“…weaknesses in computer systems) are thought about most commonly, and assets (i.e. equipment, documents, employees) least often, leading to an over-reliance on vulnerabilities-centred threat assessments (Shreeve et al 2020). Moreover, risk thinking is 'front-loaded,' as practitioners tend to think about risk in the beginning of the decision-making process, rather than systematically throughout the lifecycle of OT systems (Shreeve et al, 2020).…”

“…equipment, documents, employees) least often, leading to an over-reliance on vulnerabilities-centred threat assessments (Shreeve et al 2020). Moreover, risk thinking is 'front-loaded,' as practitioners tend to think about risk in the beginning of the decision-making process, rather than systematically throughout the lifecycle of OT systems (Shreeve et al, 2020). Meanwhile, as threats in cybersecurity evolve over time, risk management ought to be iterative and regularly updated (Ani et al, 2016;Frey et al, 2019).…”

A framework for evaluating security risk in system design

“…Further expanding these concerns, researchers have examined how applicable the established concepts of safety, reliability, and resilience are to the quick growing cyber security realm [17]. Other investigations have been performed to clearly outline the need for "decision-making actors" to be security experts due to the complexity of risk decision making [24], and some focus on how the mathematics and politics of risk clash in the realm of cyber security [2]. Work has been done by [38] to establish a meaningful monetary metric behind a risk-based approach for network architecture security modeling and design.…”