Please use this identifier to cite or link to this item: https://hdl.handle.net/10419/258014 
Year of Publication: 
2020
Citation: 
[Journal:] Risks [ISSN:] 2227-9091 [Volume:] 8 [Issue:] 2 [Article No.:] 61 [Publisher:] MDPI [Place:] Basel [Year:] 2020 [Pages:] 1-20
Publisher: 
MDPI, Basel
Abstract: 
The cost of cybersecurity incidents is large and growing. However, conventional methods for measuring loss and choosing mitigation strategies use simplifying assumptions and are often not supported by cyber attack data. In this paper, we present a multivariate model for different, dependent types of attack and the effect of mitigation strategies on those attacks. Utilising collected cyber attack data and assumptions on mitigation approaches, we look at an example of using the model to optimise the choice of mitigations. We find that the optimal choice of mitigations will depend on the goal-to prevent extreme damages or damage on average. Numerical experiments suggest the dependence aspect is important and can alter final risk estimates by as much as 30%. The methodology can be used to quantify the cost of cyber attacks and support decision making on the choice of optimal mitigation strategies.
Subjects: 
cyber risk
optimal mitigations
value at risk (VaR)
operational risk
Persistent Identifier of the first edition: 
Creative Commons License: 
cc-by Logo
Document Type: 
Article
Appears in Collections:

Files in This Item:
File
Size





Items in EconStor are protected by copyright, with all rights reserved, unless otherwise indicated.