Enhancing Cybersecurity Investment with FAIR-ROSI: A Responsible Cybersecurity Approach to Digital Society.

Area of Science:

• Information Security
• Risk Management
• Investment Analysis

Background:

• Cybersecurity investments are crucial but lack transparent evaluation methods.
• Traditional Return on Security Investment (ROSI) models often neglect key cybersecurity metrics.
• Investors struggle to accurately assess the effectiveness of their cybersecurity spending.

Purpose of the Study:

• To propose the FAIR-ROSI model, integrating the Factor Analysis of Information Risk (FAIR) with qualitative and quantitative cybersecurity metrics.
• To enhance the granularity and accuracy of traditional ROSI models.
• To provide a more transparent and effective framework for evaluating cybersecurity investments.

Main Methods:

• Development of the FAIR-ROSI model, combining the FAIR model with five qualitative and quantitative cybersecurity metrics.
• Integration of practical, measurable indicators to improve upon the traditional ROSI model.
• Evaluation of the FAIR-ROSI model through a practical case study with pre and post control measures.

Main Results:

• The FAIR-ROSI model demonstrated a narrow margin between actual and projected loss values in the case study.
• A significantly higher Return on Investment (ROI) was observed compared to total security expenditure.
• The model enhanced the granularity of investment assessment by incorporating specific cybersecurity metrics.

Conclusions:

• The FAIR-ROSI model offers a more granular and effective approach to evaluating cybersecurity investments.
• Integrating qualitative and quantitative metrics provides a clearer picture of investment efficiency and risk reduction.
• This model aids investors in better understanding and justifying their cybersecurity spending.