Security Events and Vulnerability Data for Cybersecurity Risk Estimation.

Area of Science:

• Cybersecurity Risk Management
• Quantitative Risk Assessment
• Information Security

Background:

• Current cybersecurity risk estimation relies on qualitative matrices, unlike other sectors (e.g., Finance with Basel II) that use quantitative methods.
• Existing qualitative approaches may not accurately reflect the true probability of cyber attacks.
• A significant gap exists between traditional qualitative risk assessments and quantitative methodologies in cybersecurity.

Purpose of the Study:

• To present a novel model and methodology for quantitatively estimating the probability of cyber attacks.
• To leverage data from an organization's Security Operation Center (SOC) for more accurate risk assessment.
• To address untargeted, automated, and two-stage cyber attacks prevalent in the wild.

Main Methods:

• Developed a quantitative model to estimate attack probability using SOC data.
• Incorporated attacker capabilities, defined as the number of weaponized vulnerabilities.
• Modeled two-stage attacks: initial breach of internet-facing systems followed by internal escalation.
• Methodology is adjustable to align with an organization's specific risk appetite.

Main Results:

• Demonstrated a quantitative approach to estimate attack probability, contrasting with qualitative industry standards.
• Successfully applied the methodology using data from a large financial institution.
• Highlighted a significant discrepancy between traditional qualitative risk assessments and the proposed quantitative approach.

Conclusions:

• The proposed quantitative methodology offers a more precise estimation of cybersecurity risk compared to qualitative matrices.
• Leveraging SOC data enables a data-driven approach to understanding and mitigating cyber threats.
• This quantitative model provides a valuable tool for organizations to better manage their cybersecurity posture and risk exposure.