An Adversarial Risk Analysis Framework for Cybersecurity
David Ríos Insua (Consejo Superior de Investigaciones Científicas CSIC)
Aitor Couce-Vieira (Consejo Superior de Investigaciones Científicas CSIC)
Jose A. Rubio (Universidad Complutense de Madrid)
W. Pieters (TU Delft - Organisation & Governance)
Katiaryna Labunets (TU Delft - Organisation & Governance)
Daniel G. Rasines (Imperial College London)
More Info
expand_more
Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.
Abstract
Risk analysis is an essential methodology for cybersecurity as it allows organizations to deal with cyber threats potentially affecting them, prioritize the defense of their assets, and decide what security controls should be implemented. Many risk analysis methods are present in cybersecurity models, compliance frameworks, and international standards. However, most of them employ risk matrices, which suffer shortcomings that may lead to suboptimal resource allocations. We propose a comprehensive framework for cybersecurity risk analysis, covering the presence of both intentional and nonintentional threats and the use of insurance as part of the security portfolio. A simplified case study illustrates the proposed framework, serving as template for more complex problems.
help_outline