MAGIC: A Method for Assessing Cyber Incidents Occurrence

The assessment of cyber risk plays a crucial role for cybersecurity management, and has become a compulsory task for certain types of companies and organizations. This makes the demand for reliable cyber risk assessment tools continuously increasing, especially concerning quantitative tools based on...

Full description

Saved in:
Bibliographic Details
Published in:IEEE access 2022, Vol.10, p.73458-73473
Main Authors: Battaglioni, Massimo, Rafaiani, Giulia, Chiaraluce, Franco, Baldi, Marco
Format: Article
Language:English
Subjects:
Computer security
Cyber incident
cyber risk
Cybersecurity
Evaluation
Factor analysis
FAIR
HTMA
IEC Standards
ISO Standards
Organizations
Probabilistic logic
Probabilistic models
Probabilistic risk assessment
Risk analysis
Risk assessment
Risk management
Standards organizations
Statistical analysis
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:The assessment of cyber risk plays a crucial role for cybersecurity management, and has become a compulsory task for certain types of companies and organizations. This makes the demand for reliable cyber risk assessment tools continuously increasing, especially concerning quantitative tools based on statistical approaches. Probabilistic cyber risk assessment methods, however, follow the general paradigm of probabilistic risk assessment, which requires the magnitude and the likelihood of incidents as inputs. Unfortunately, for cyber incidents, the likelihood of occurrence is hard to estimate based on historical and publicly available data; so, expert evaluations are commonly used, which however leave space to subjectivity. In this paper, we propose a novel probabilistic model, called MAGIC (Method for AssessinG cyber Incidents oCcurrence), to compute the likelihood of occurrence of a cyber incident, based on the evaluation of the cyber posture of the target organization. This allows deriving tailor-made inputs for probabilistic risk assessment methods, like HTMA (How To Measure Anything in cybersecurity risk), FAIR (Factor Analysis of Information Risk) and others, thus considerably reducing the margin of subjectivity in the assessment of cyber risk. We corroborate our approach through a qualitative and a quantitative comparison with several existing methods.
ISSN:2169-3536
2169-3536
DOI:10.1109/ACCESS.2022.3189777