Optimal Selection of Security Countermeasures for Effective Information Security

How does supply chain knowledge enhance green innovation? The mediation mechanisms of corporate reputation and non-supply chain learning

“…These signals are used by external parties as a means to mitigate uncertainty linked with unfamiliar agents in a knowledge market (Lichtenthaler and Ernst, 2007). Reputable firms can attract more valuable external partners (Gassmann et al, 2009) and inspire knowledge sharing (Zhang et al, 2015;Sarala et al, 2016). In this way, corporate reputation promotes the implementation of trust-based relationships between a focal firm and its supplier chain partners to freely share information, expertise, skills and experiences.…”

Effect of Security Controls on Patching Window: A Causal Inference based Approach

“…Security Control Scoring: Dor and Elovici [9] identify great differences in the ways organisations make security control decisions influenced by a multitude of criteria, including policy, competitive advantage, financial considerations, quality, compliance, customer expectations, and strategy. Effectiveness of Controls is assessed based on their cost [12, 13, 20, 23-25, 35, 36, 44, 46, 56] and difficulty of implementation [4]; operation, training, and maintenance cost [34,54]; efficiency, effectiveness, performance, degree or number of threats addressed [4,12,34,44,54]; alignment with applicable standards, laws, and regulations [28,34], and stakeholder preferences [10]. Most of the work surveyed either run operation research (OR) simulations or relied on SME surveys to score security controls.…”

Multi-Criteria Selection of Capability-Based Cybersecurity Solutions

“… Business impact/disruption, anticipated loss, profit reduction, fines, reputation, decline in stock price, damage [17]- [23]  Risk tolerance [12], [19], [24]; Budget [19]  Legal and regulatory [22]  Self-imposed constraints [22] Asset  Importance/value [13], [24]- [27]  Assessed risk [12], [24]  Probability of breach, event, or successful attack [13], [24], [26], [28], [29] Threat  Anticipated [25], [27], [30], [31]  Most significant [25]  Residual risk [23], [32]; Incident data [17] Control  Cost, general [12], [13], [30], [32], [18], [20]- [23], [26]- [28]  Purchase/setup [17], [24], [25], [33]- [35]  Number of controls as a proxy for cost [36]  Difficulty of implementation [25]  Operation, training, and maintenance cost [17], [24], [25],…”

“…It is used to analyze problems where there are some measures of costs and benefits that can be traded off to arrive at the best solution under the given constraints. Researchers investigate a number of MCDM techniques for this problem, some of which include or are based on fuzzy set theory [34], multi-attribute utility theory (i.e., value functions, knapsack strategy) [18], [27], [30], [37], evolutionary multi-objective optimization (EMO) also known as genetic algorithms [13], [20], [23], [26], [32], [35], analytic hierarchy process (AHP) [31], grey relational analysis (GRA) [25], simple additive weighting (SAW) [17], the technique for order preference by similarity to ideal solution (TOP-SIS) [25], and preference ranking organization method for enrichment evaluation (PROMETHEE) [33].…”