Quantifying information security risks using expert judgment elicitation

A Large-Scale Study of the Time Required to Compromise a Computer System

“…There are various research efforts on modeling cyber intrusions, for example, to measure the security of a system (or system-of-systems) [5], [6], [7], [8], [9], [10]. These studies make various assumptions to support their claims; a frequent one being that attacks, or intrusions, follow a Poisson process, i.e., that the number of attacks or intrusions is well modeled by a Poisson distribution and that the time between such events is exponentially distributed.…”

“…In the same fashion as in the area of dependable computing, various research efforts have been made to enable estimating and predicting the security of a system (e.g., [5], [6], [7], [8], [9], [10]). Many such models origin from the domain of dependable computing [4], for example, how many intrusions that occur for a certain system (compared to faults).…”

“…This assumption has been criticized by empirical observations on various occasions [1], [2], [3], but is still applied by both researchers and practitioners (e.g., [12], [13], [14]) -much due to its mathematical simplicity. In the domain of cyber security, system compromises are often assumed to follow a Poisson distribution (e.g., [5], [6], [7], [8]). However, this assumption has never been thoroughly tested.…”

An Effective Method of Time Required to Compromise a Computer System

“…These analysis make many realistic to support their claims; a frequent one being that attacks, or intrusions, follows a Poisson process that the number of attacks or intrusions is well modeled by a Poisson distribution and that the time taken between such events is ideally distributed. In the paper [7,8,9] at the best of the author's knowledge, there is only one publication that an idea of the distribution of TTC using empirical information in data. The authors have observed that a total of 59 breaches, each of which them were categorized into one of six classes depending on the amount of hours taken to perform it [6].…”

Identifying Security Risk Modules in Information Systems

“…They provide a comprehensive survey of research and show that there is not sufficient empirical evidence to corroborate the hypothesis that computer and information "security can cor-rectly be represented with quantitative information" (Verendel, 2009, p. 37). In our paper, we do follow the numerous researchers attempting to quantify IT security risks (e.g., Feng & Li, 2011;Ryan et al, 2012;Rebollo, et al, 2015). This quantification may be used to construct a relationship between improvement and investment and allow gradual, optimal investment as in Giat (2013).…”