Risk Countermeasures Based on Five Whys Analysis Considering Offensive Security

Tanimoto, Shigeaki; Nakajima, Ryusei; Goromaru, Hideki; Hatashima, Takashi; Kanai, Atsushi

doi:10.1109/gcce59613.2023.10315404

Cited by 1 publication

(1 citation statement)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…More recently, the occurrence of internal fraud in combination with cyber risks (information leakage) and psychological risks (application of a fraud triangle (opportunity, pressure, rationalization, etc.) [16]) has become apparent.…”

Section: Ultra-high Probabilitymentioning

confidence: 99%

Countermeasure Portfolio Management of Silent Cyber Risks for Suitable Return of Investment

Tanimoto,

Mishina,

Goromaru

et al. 2024

International Journal of Service and Knowledge Management

View full text Add to dashboard Cite

In recent years, with the continuing development of the Internet of Things (IoT), various devices are now connected a huge number of networks and are being used for diverse purposes. The IoT has the potential to link cyber risks to actual property damage, as cyberspace risks are connected to physical space. With this increase in unknown cyber risks, the demand for cyber insurance is increasing. One of the most serious emerging risks is the silent cyber risk, and it is only likely to increase in the future. However, at present, security countermeasures against silent cyber risks are insufficient. In this paper, we propose a countermeasure portfolio management of silent cyber risk for organizations with the objective of contributing to the development of risk management methods against new cyber risks. Specifically, we modeled silent cyber risk by focusing on state transitions to different risks. We newly defined two types of silent cyber risk, Alteration risk and Combination risk, and conducted a risk assessment that identified 23 risk factors. After analyzing them, we found that all were classified as Risk Transference. We clarified that the most effective risk countermeasure for Alteration risk was insurance and for Combination risk was countermeasures to reduce the impact of the risk factors themselves. Our evaluation showed that the silent cyber risk could be reduced by about 50%, thus demonstrating the effectiveness of the proposed countermeasures. We also investigated the risk assessment results of silent cyber risk from the operational perspective. Specifically, we applied portfolio management based on the return on investment of risk countermeasures for silent cyber risks and found that proactive countermeasures tended to have higher priority.

show abstract

Section: Ultra-high Probabilitymentioning

confidence: 99%