Total cost of security

Abstract

This is an extended abstract of the presentation of the same title for the Cyber Security and Information Intelligence Research Workshop, 2009.

How Bad is it? – A Branching Activity Model to Estimate the Impact of Information Security Breaches

“…Thomas (2009b) builds on this to propose a method for pricing risk to facilitate enterprise-level risk management and risk pooling. Estimation of impact losses is a key element of their proposed methods.…”

“…Borg (2005) presented a qualitative analysis of economically complex attacks and breach episodes, and discussed branching processes for consequences among others. Thomas (2009b) presented a framework for pricing risk associated with information security, and it included suggestions regarding methods to estimate frequency and severity of major breach episodes.…”

“…This could include traditional cyber insurance (Department of Homeland Security 2012, Heal 2012, Zhao et al 2009) or innovative institutions (Kupiec and O'Brien 1997, Sommer and Loch 2009, Thomas and Amon 2007, Thomas 2009b). …”