Quantitative Assessment of Cybersecurity Risks for Mitigating Data Breaches in Business Systems
Source abstract
Abstract
The evaluation of data breaches and cybersecurity risks has not yet been formally addressed in modern business systems. There has been a tremendous increase in the generation, usage and consumption of industrial and business data as a result of smart and computational intensive software systems. This has resulted in an increase in the attack surface of these cyber systems. Consequently, there has been a consequent increase in the associated cybersecurity risks. However, no significant studies have been conducted that examine, compare, and evaluate the approaches used by the risk calculators to investigate the data breaches. The development of an efficient cybersecurity solution allows us to mitigate the data breaches threatened by the cybersecurity risks such as cyber-attacks against database storage, processing and management. In this paper, we develop a comprehensive, formal model that estimates the two components of security risks: breach cost and the likelihood of a data breach within 12 months. The data used in this model are taken from the industrial business report, which provides the necessary information collected and the calculators developed by the major organizations in the field. This model integrated with the cybersecurity solution uses consolidated factors that have a significant impact on the data breach risk. We propose mathematical models of how the factors impact the cost and the likelihood. These models allow us to conclude that results obtained through the models mitigate the data breaches in the potential and future business system dynamically.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Information and Cyber Security · Network Security and Intrusion Detection · Cloud Data Security Solutions
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Computer Science Department, King Abdulaziz University, Jeddah 21589, Saudi Arabia
Computer Science Department, Colorado State University, Fort Collins, CO 80523, USA
Funding
King Abdulaziz University
References (44)
Show source-provided references
1. Application of vulnerability discovery models to major operating systems10.1109/TR.2008.916872 ↗
2. Ponemon Institute (2021, March 30). 2013 Cost of Data Breach Study: The US Sponsored by Symantec. Available online: http://www.symantec.com/content/en/us/about/media/pdfs/b-cost-of-a-data-breach-us-report-2013.en-us.pdf.
3. Algarni, A.M., and Malaiya, Y.K. (2016, January 7–8). A consolidated approach for estimation of data security breach costs. Proceedings of the 2016 2nd International Conference on Information Management (ICIM), London, UK.10.1109/INFOMAN.2016.7477530 ↗
4. A methodology for estimating the tangible cost of data breaches
5. Precision health data: Requirements, challenges and existing techniques for data security and privacy10.1016/j.compbiomed.2020.104130 ↗
6. Ponemon Institute (2021, March 30). 2020 Cost of Data Breach Study: The US. Sponsored by IBM. Cost of a Data Breach Report 2020|IBM. Available online: https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/.10.1016/S1361-3723(21)00082-8 ↗
7. The information content of Sarbanes-Oxley in predicting security breaches10.1016/j.cose.2019.101687 ↗
8. Defining organizational information security culture—Perspectives from academia and industry10.1016/j.cose.2020.101713 ↗
9. A comprehensive model of information security factors for decision-makers10.1016/j.cose.2020.101747 ↗
10. Quantifiable & Comparable Evaluations of Cyber Defensive Capabilities: A Survey & Novel, Unified Approach10.1016/j.cose.2020.101907 ↗
11. Examining the costs and causes of cyber incidents
12. Strategic news bundling and privacy breach disclosures10.1093/cybsec/tyx009 ↗
13. Sun, H., Xu, M., and Zhao, P. (2020). Modeling Malicious Hacking Data Breach Risks. N. Am. Actuar. J., 1–19.
14. A survey on privacy and security of Internet of Things10.1016/j.cosrev.2020.100312 ↗
15. Jouini, M., Rabai, L.B.A., and Khedri, R. (2020). A quantitative assessment of security risks based on a multifaceted classification approach. Int. J. Inf. Secur., 1–18.10.1007/s10207-020-00515-6 ↗
16. A Cost-Optimization Scheme Using Security Vulnerability Measurement for Efficient Security Enhancement
17. Quantitative assessment and driving force analysis of vegetation drought risk to climate change: Methodology and application in Northeast China10.1016/j.agrformet.2019.107865 ↗
18. Fusco, F., Allocca, V., Coda, S., Cusano, D., Tufano, R., and De Vita, P. (2020). Quantitative Assessment of Specific Vulnerability to Nitrate Pollution of Shallow Alluvial Aquifers by Process-Based and Empirical Approaches. Water, 12.10.3390/w12010269 ↗
19. HIPAA (2019). 2019 Data Breach Barometer Report Shows the Massive Increase in Exposed Healthcare Records. HIPAA J., Available online: https://www.hipaajournal.com/2019-data-breach-barometer-report-shows-massive-increase-in-exposed-healthcare-records/.
20. Forgerock (2019). Consumer Data Breach Report 2019: Personally Identifiable Information Targeted in Breaches that Impact Billions of Records, Forgerock. Forgerock Breach Report 2019.
21. Privacy-preserving techniques of genomic data-a survey10.1093/bib/bbx139 ↗
22. Analyzing Ponemon Cost of Data Breach
23. Team, Verizon RISK (2021, March 30). 2015 Data Breach Investigations Report. Available online: http://www.verizonenterprise.com/DBIR/2015/.
24. Weiss, N.E., and Miller, R.S. (2021, March 30). The Target and Other Financial Data Breaches: Frequently Asked Questions Congressional Research Service. Available online: https://fas.org/sgp/crs/misc/R43496.pdf.
25. (2021, March 30). Target Reports Fourth Quarter and Full-Year 2014 Earnings. Available online: http://investors.target.com/phoenix.zhtml?c=65828&p=irol-newsArticle&ID=2019880.
26. (2021, March 30). Target Reports Fourth Quarter and Full-Year 2015 Earnings. Available online: http://investors.target.com/phoenix.zhtml?c=65828&p=irol-newsArticle&ID=2142619.
27. (2021, March 30). Data Breaches May Cost Less Than the Security to Prevent Them. TechRepublic. Available online: http://www.techrepublic.com/article/data-breaches-may-cost-less-than-the-security-to-prevent-them/.
28. PYMNTS (2021, March 30). How Much Did the Target, Home Depot Breaches Really Cost. Available online: http://www.pymnts.com/news/2015/target-home-depot-reveal-full-breach-costs/.
29. Ponemon Institute (2021, March 30). Why Ponemon Institute’s Cost of Data Breach Methodology Is Sound and Endures. Available online: https://www.ponemon.org/news-updates/blog/security/why-ponemon-institutes-cost-of-data-breach-methodology-is-sound-and-endures.html.
30. NetDiligence (2021, March 30). 2015 Cyber Claims Study. Available online: http://netdiligence.com/downloads/NetDiligence_2015_Cyber_Claims_Study_093015.pdf.
31. Business Dictionary (2021, March 30). Definition of Economy of Scale. Available online: http://www.businessdictionary.com.
32. Ponemon Institute (2021, March 30). 2014 Cost of Data Breach Study: United States. Sponsored by Symantec. Available online: http://public.dhe.ibm.com/comon/ssi/ecm/se/en/sel03017usen/SEL03017USEN.PDF.
33. Understanding the full cost of cybersecurity breaches
34. Chulani, S., and Barry, B. (1999). Modeling Software Defect Introduction and Removal: COQUALMO (Constructive Quality Model), University of Southern California, Center for Software Engineering. Technical Report No. USC-CSE-99-510.
35. Lee, S. (2010). Software Reliability Management. Encyclopedia of Library and Information Sciences, Taylor and Francis. [3rd ed.].
36. Aroonvatanaporn, P., Supannika, K., and Barry, B. (2012, January 2–3). COTIPMO: A constructive team improvement process model. Proceedings of the 2012 International Conference on Software and System Process (ICSSP), Zurich, Switzerland.10.1109/ICSSP.2012.6225977 ↗
37. Modeling and Prediction of the Reliability Analysis of an 18-Pulse Rectifier Power Supply for Aircraft Based Applications10.1109/ACCESS.2020.2977197 ↗
38. Ponemon Institute (2021, March 30). 2015 Cost of Data Breach Study: United States. Sponsored by IBM. Available online: http://www-01.ibm.com/common/ssi/cgi-bin/ssialias?infotype=SA&subtype=WH&htmlfid=SEW03055USEN.
39. Market Watch (2021, March 30). 3 Reasons Why Cyberattacks Don’t Hurt Stock Prices. Available online: http://www.marketwatch.com/story/3-reasons-why-cyberattacks-dont-hurt-stock-prices-2015-04-03.
40. Ponemon Institute (2021, March 30). 2015 Cost of Data Breach Study: Global Analysis. Sponsored by IBM. Available online: http://www-01.ibm.com/common/ssi/cgi-bin/ssialias?infotype=SA&subtype=WH&htmlfid=SEW03053WWEN.
41. Security Week (2021, March 30). LinkedIn: Breach Cost Up to $1M, Says $2–3 Million in Security Upgrades Coming. Available online: http://www.securityweek.com/linkedin-breach-cost-1m-says-2-3-million-security-upgrades-coming.
42. Clif Bar and Company (2021, March 30). Organic Energy Bar Market Growth Probability and Future Scenario by 2031. Available online: https://www.marketwatch.com/press-release/organic-energy-bar-market-growth-probability-and-future-scenario-by-2031-clif-bar-and-company-2021-02-02?siteid=bigcharts&dist=bigcharts&tesla=y.
43. Assessing and forecasting cybersecurity impacts10.1287/deca.2020.0418 ↗
44. Malaiya, Y.K. (2020). Quantitative Cyber-Security, Colorado State University. Available online: https://www.cs.colostate.edu/~cs559/f20/slides/L17.pdf.