A Multivariate Model to Quantify and Mitigate Cybersecurity Risk

Abstract

The cost of cybersecurity incidents is large and growing. However, conventional methods for measuring loss and choosing mitigation strategies use simplifying assumptions and are often not supported by cyber attack data. In this paper, we present a multivariate model for different, dependent types of attack and the effect of mitigation strategies on those attacks. Utilising collected cyber attack data and assumptions on mitigation approaches, we look at an example of using the model to optimise the choice of mitigations. We find that the optimal choice of mitigations will depend on the goal—to prevent extreme damages or damage on average. Numerical experiments suggest the dependence aspect is important and can alter final risk estimates by as much as 30%. The methodology can be used to quantify the cost of cyber attacks and support decision making on the choice of optimal mitigation strategies.

Cyber Risk Quantification: Investigating the Role of Cyber Value at Risk

“…Looking at literature on cyber security, with regard to frequency, it is generally modeled by either a Poisson or a negative binomial distribution (Eling and Loperfido 2017). (Bentley et al 2020) suggest that a suitable way to model the effect of mitigation on the frequency of attacks, is to resort to a Poisson process.…”

“…Another issue concerns the dependability structure of losses, requiring a model able to deal with various, but dependent, classes of damages (Bentley et al 2020). In order to model dependency structure, copulas are commonly used (Bentley et al 2020;Eling and Jung 2018).…”

“…Another issue concerns the dependability structure of losses, requiring a model able to deal with various, but dependent, classes of damages (Bentley et al 2020). In order to model dependency structure, copulas are commonly used (Bentley et al 2020;Eling and Jung 2018). Recent actuarial studies focus on modelling the dependence between the claim frequency and the average severity (Alemany et al 2021).…”

“…Another critical issue is the estimation of mitigation effects of investments in security. Bentley et al (2020) propose an interesting model for mitigation that targets frequency and severity separately.…”

Insurance of Cyber Risks in International Transport

“…It should be mentioned, that operators providing intelligent public transport services don't spend sufficient financial sources on development, 4 security and maintenance of security systems. 5 For that reason are state departments and agencies adopting measures for mitigation, planning and 1 Cyber attack is defined as "attack on IT infrastructure in order to cause damage, or to obtain sensitive or strategically important information" (Jirásek, P., Novák, L., Požár, J. (2015) Výkladový slovník Kybernetické bezpečnosti, Prague: PA CR in Prague, Czech branch of AFCEA, p. 71).…”