Cybersecurity Acquisition Framework Based on Risk Management: Economics Perspective

Abstract

Cyber attacks continuously target organizations, however, the mitigation actions taken for defense are not sufficiently effective. Ability to compute the cost of attacks is crucial to assess the effectiveness of countermeasure investments. In this study, we developed a framework to have a well-informed decision-making process in cybersecurity acquisition by evaluating the business impact caused by the operability losses of assets. We tested the developed framework using various attack and mitigation scenarios. The findings suggest that using a simulation approach to calculate the business impact of cyber attacks provides the ability to support decision-making process.