Premium
Multicriteria Decision Framework for Cybersecurity Risk Assessment and Management
Author(s) -
Ganin Alexander A.,
Quach Phuoc,
Panwar Mahesh,
Collier Zachary A.,
Keisler Jeffrey M.,
Marchese Dayton,
Linkov Igor
Publication year - 2020
Publication title -
risk analysis
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.972
H-Index - 130
eISSN - 1539-6924
pISSN - 0272-4332
DOI - 10.1111/risa.12891
Subject(s) - risk analysis (engineering) , vulnerability (computing) , computer science , risk management , process (computing) , computer security , stakeholder , vulnerability assessment , risk assessment , bayesian network , probabilistic logic , set (abstract data type) , process management , management science , engineering , business , artificial intelligence , psychology , public relations , finance , psychological resilience , political science , psychotherapist , operating system , programming language
Risk assessors and managers face many difficult challenges related to novel cyber systems. Among these challenges are the constantly changing nature of cyber systems caused by technical advances, their distribution across the physical, information, and sociocognitive domains, and the complex network structures often including thousands of nodes. Here, we review probabilistic and risk‐based decision‐making techniques applied to cyber systems and conclude that existing approaches typically do not address all components of the risk assessment triplet (threat, vulnerability, consequence) and lack the ability to integrate across multiple domains of cyber systems to provide guidance for enhancing cybersecurity. We present a decision‐analysis‐based approach that quantifies threat, vulnerability, and consequences through a set of criteria designed to assess the overall utility of cybersecurity management alternatives. The proposed framework bridges the gap between risk assessment and risk management, allowing an analyst to ensure a structured and transparent process of selecting risk management alternatives. The use of this technique is illustrated for a hypothetical, but realistic, case study exemplifying the process of evaluating and ranking five cybersecurity enhancement strategies. The approach presented does not necessarily eliminate biases and subjectivity necessary for selecting countermeasures, but provides justifiable methods for selecting risk management actions consistent with stakeholder and decisionmaker values and technical data.