Cyber risk quantification
 | This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these messages)
|
Cyber-Risk Quantification involves the application of risk quantification techniques to an organization's Cyber-Security Risk. Cyber-Risk quantification is the process of evaluating the Cyber-Risks that have been identified and then validating, measuring and analysing the available Cyber-Data using mathematical modelling techniques to accurately represent the organization's Cyber-Security environment in a manner that can be used to make informed Cyber-Security infrastructure investment and risk transfer decisions. Cyber-Risk Quantification is a supporting activity to Cyber-Security Risk Management; Cyber-Security Risk Management is a component of Enterprise Risk Management and is especially important in organizations and enterprises that are highly dependent upon their Information Technology (IT) networks and systems for their business operations.
One method of quantifying Cyber-Risk is the Value-at-Risk (VaR) method discussed at the January 2015 World Economic Forum meeting (see external reference below). At this meeting, VaR was investigated and deemed to be a viable method of quantifying Cyber-Risk; other methods of quantifying Cyber-Risk also exist (refer to sections below). However, to quantify Cyber-Risk, one must first define Cyber-Risk. Cyber-Security concerns (e.g. system penetration by external actors) are only one component of Cyber-Risk; other components of Cyber-Risk include Functional & Non-Functional triggers related to the programme code itself (e.g. Internet Banking transacts inappropriately or unintentionally). Indeed, all Cyber-Risk may be characterised by a single common description; that is, they all represent undiscovered defects (of 'some' form). If Cyber-Risks are known, they're no longer Risks, they're Issues & can be countered or prevented.
A commonly overlooked requirement pertaining to Cyber-Risk is that one must first know one's Cyber-Confidence. Given that Risk represents unknowns, one must first quantify the knowns (i.e. the Confidence) in order to calculate the unknowns. To quantify Cyber-Risk prior to quantifying Cyber-Confidence is meaningless (refer to Mathematical Definition). Unfortunately & most often, the need to understand Cyber-Confidence prior to determining Cyber-Risk is bypassed:
- Practical analogy:
- Before crossing a busy street, one assesses one's Confidence of being able to execute the manoeuvre prior to assessing the Risk of doing so
- Important takeaways:
- Understanding Cyber-Confidence always precedes understanding Cyber-Risk
- Cyber-Risk can only ever be calculated, it can never be measured directly because it represents 'the unknown'; however, Cyber-Risk can be predicted utilising Mathematics (refer to Tools section)
- The equation shown in the Mathematical Definition section contains two variables (Cyber-Risk & Cyber-Confidence). If both are unknown, the equation cannot be solved; hence, knowledge of at least one of them is always required
Tools
Cyber-Risk Quantification can be an automated or software supported process allowing Users to construct mathematical models to quantify Cyber-Security Risks; examples are:
- Statistical Mechanics & Probability Theory
- Common Vulnerability Scoring System Calculator (NIST) (FIRST)
Mathematical Definition
The mathematical definition of Cyber-Risk is as follows:
- Cyber-Risk = 1 - Cyber-Confidence
'Cyber-Confidence' is / are the actual executed tests which have passed. This value can be converted to a statistical probability & the associated Cyber-Risk calculated:
- Example-1: 'A certain number' of tests have been executed & passed. Let's imagine that it yields a Defect-Free Confidence of 97.43%. Answer: Cyber-Risk = 2.57%.
- Example-2: All 65,536 TCP ports & 65,536 UDP ports are confirmed to be dead or inactive on an asset; how resistant to penetration is it ? Answer: Cyber-Confidence = 99.83%, Cyber-Risk = 0.17%
Typically, this form of Cyber-Confidence &/or Cyber-Risk estimation is termed Testimation because:
- It can be applied to estimate the number of tests required for any desired level of Cyber-Confidence
- It can be applied to estimate the Cyber-Confidence (& Cyber-Risk) based upon the number of tests which have actually been executed & passed