Systematic Review: Cybersecurity Risk Taxonomy

Abstract

In cybersecurity, the identification of risks is a fundamental part because this activity is not unique to cybersecurity and it is hard to know what the risks in this area are. This study aims to identify if there are some risk taxonomies in cybersecurity. For this, a systematic review of the studies published from 1990 to 2017 was carried out. We found 132 papers and some of them mention some risk taxonomies within the scope of IT (information technologies) cybersecurity, although only five primary elements were selected, identifying the main risk taxonomies. A classification of cybersecurity risk taxonomy types has been adapted, with the inclusion of new categories, categorized according to their perspective and domain. We have analysed the taxonomies form a proposed five level perspective. Finally, it has been observed that risk taxonomies may be shifting the focus from the asset level to service and business level.

Cyber loss model risk translates to premium mispricing and risk sensitivity

“…There is an ongoing exploration on the various ways to classify and taxonomise cyber risk loss events, see discussions in Shevchenko et al (2023), Rea-Guaman et al (2017) and Elnagdy et al (2016). In this study the focus has been on the U.S. cyber risk experience as it is generally the environment where the largest commercial cyber loss data collection effort has been instigated, both in terms of breadth of industry and loss type as well as in terms of duration of collection and reporting.…”

Cyber Loss Model Risk Translates to Premium Mispricing and Risk Sensitivity

“…There is an ongoing exploration on the various ways to classify and taxonomize cyber risk loss events, see discussions in [7,23] and [24]. In this study the focus has been on the US cyber risk experience as it is generally the environment where the largest commercial cyber loss data collection effort has been instigated, both in terms of breadth of industry and loss type as well as in terms of duration of collection and reporting.…”

AVARCIBER: a framework for assessing cybersecurity risks

“…Considering that cybersecurity risks are the starting point of all cybersecurity maturity models, a systematic review (SR) regarding cybersecurity risk taxonomies was carried out [24]. In this SR, it was found that some articles [12][13][14] identify international standards as references, such as the standards of the National Institute of Standards and Technology (NIST) [15].…”

“…From the snowball technique [25] applied to the articles obtained by the systematic review [24], the main elements of the conceptual model of cybersecurity risk management and their relationships have been determined. This information has served as the basis for the design of the proposed conceptual model.…”