Decision support approaches for cyber security investment

Abstract

When investing in cyber security resources, information security managers have to follow effective decisionmaking\ud strategies. We refer to this as the cyber security investment challenge.In this paper, we consider\ud three possible decision support methodologies for security managers to tackle this challenge. We consider\ud methods based on game theory, combinatorial optimisation, and a hybrid of the two. Our modelling starts\ud by building a framework where we can investigate the effectiveness of a cyber security control regarding\ud the protection of different assets seen as targets in presence of commodity threats. As game theory captures\ud the interaction between the endogenous organisation’s and attackers’ decisions, we consider a 2-person\ud control game between the security manager who has to choose among different implementation levels of a\ud cyber security control, and a commodity attacker who chooses among different targets to attack. The pure\ud game theoretical methodology consists of a large game including all controls and all threats. In the hybrid\ud methodology the game solutions of individual control-games along with their direct costs (e.g. financial) are\ud combined with a Knapsack algorithm to derive an optimal investment strategy. The combinatorial optimisation\ud technique consists of a multi-objective multiple choice Knapsack based strategy. To compare these\ud approaches we built a decision support tool and a case study regarding current government guidelines. The\ud endeavour of this work is to highlight the weaknesses and strengths of different investment methodologies\ud for cyber security, the benefit of their interaction, and the impact that indirect costs have on cyber security\ud investment. Going a step further in validating our work, we have shown that our decision support tool provides\ud the same advice with the one advocated by the UK government with regard to the requirements for\ud basic technical protection from cyber attacks in SMEs

Decision Making and Biases in Cybersecurity Capability Development: Evidence from a Simulation Game Experiment

“…In general, by allocating resources to cybersecurity capabilities, managers can not only effectively reduce potential losses due to cyberattacks, but also improve overall performance of their operations [22]. It remains that the diversion of funds away from profit-making processes and assets reduces cash flow [41]; this issue is exacerbated in small and medium-sized enterprises where there is often little or no additional funding available for cybersecurity [42]. Furthermore, unlike investors who can diversify their holdings according to their appetite for risk, managers often have limited tenure in their organizations and have little choice in dealing with the risk that their company faces.…”

Cyber-Security and Combatting Cyber-Attacks: A Study

“…It processes through a malware and doesn't require any kind of activity by the client to download [24].…”

Selection of Pareto-efficient response plans based on financial and operational assessments

“…[34] presents an interesting and well-formalized approach for situations where too few budget exists to fully implement all mitigation actions to known attack surfaces. [35], [36], and Fiedler [37] consider a defender-attacker interaction as strategic games and present well-formalized definitions and well-defined problems for winning these games based on a cost optimization. Other cost-focused approaches are proposed in [32,36,38,39].…”