Risk assessment uncertainties in cybersecurity investments
type: Item
instance of: scholarly article
title: Risk assessment uncertainties in cybersecurity investments
zbMATH Open document ID: 1402.91193
author: Andrew Fielder
author: Sandra König
author: Emmanouil Panaousis
author: Stefan Schauer
author: Stefan Rass
published in: Games
publication date: 2018-07-10T00:00:00Z
review text: Summary: When undertaking cybersecurity risk assessments, it is important to be able to assign numeric values to metrics to compute the final expected loss that represents the risk that an organization is exposed to due to cyber threats. Even if risk assessment is motivated by real-world observations and data, there is always a high chance of assigning inaccurate values due to different uncertainties involved (e.g., evolving threat landscape, human errors) and the natural difficulty of quantifying risk. Existing models empower organizations to compute optimal cybersecurity strategies given their financial constraints, i.e., available cybersecurity budget. Further, a general game-theoretic model with uncertain payoffs (probability-distribution-valued payoffs) shows that such uncertainty can be incorporated in the game-theoretic model by allowing payoffs to be random. This paper extends previous work in the field to tackle uncertainties in risk assessment that affect cybersecurity investments. The findings from simulated examples indicate that although uncertainties in cybersecurity risk assessment lead, on average, to different cybersecurity strategies, they do not play a significant role in the final expected loss of the organization when utilising a game-theoretic model and methodology to derive these strategies. The model determines robust defending strategies even when knowledge regarding risk assessment values is not accurate. As a result, it is possible to show that the cybersecurity investments' tool is capable of providing effective decision support.
Mathematics Subject Classification ID: 91B30
Mathematics Subject Classification ID: 91A15
Mathematics Subject Classification ID: 94A62
zbMATH DE Number: 6901044
zbMATH Keywords: risk assessment
zbMATH Keywords: cybersecurity investments
zbMATH Keywords: game theory
describes a project that uses: HyRiM
MaRDI profile type: Publication
full work available at URL: g9020034
OpenAlex ID: W2805466842
cites work: Uncertainty in Games: Using Probability-Distributions as Payoffs
cites work: Q4117280
Wikidata QID: Q129706354
DOI: 10.3390/G9020034
description: scientific article; zbMATH DE number 6901044