Cyber Trust Index: A Framework for Rating and Improving Cybersecurity Performance
Source abstract
Abstract
Cybersecurity risk is among the top risks that every organization must consider and manage, especially during this time wherein technology has become an integral part of our lives; however, there is no efficient and simplified measurement method that organizations or regulators could use, as frequently as they need, to evaluate and compare the outcome of cybersecurity efforts that have been put in place. Consequently, this has resulted in an absence of critical data for cybersecurity improvement. This research proposes a Cyber Trust Index (CTI), a novel and simplified framework for evaluating, benchmarking, and improving organizations’ cybersecurity performance. Methods: The researchers analyzed prominent scientific research papers and widely used security standards to develop baseline security controls that serve as a measurement foundation. Then, they identified Control Enablers and Capability Tiers that were used as base measures and measurement methods. The CTI framework was evaluated by experts and tested with 35 organizations from the critical information infrastructure (CII) sector, as well as other generic sectors, in Thailand to confirm its validity and reliability in real organization settings and identify the priorities and factors that can contribute to better cybersecurity performance. Results: The CTI has two key elements: the baseline controls and rating methods. The baseline controls comprise 12 dimensions, 25 clusters, and 70 controls. The rating methods utilize five control enablers and five capability tiers to compute scores. A binary questionnaire is used to capture data for the rating process. Based on a statistical analysis of CTI results from 35 pilot organizations, 28.57% are in the beginner group with high-risk exposure, 31.43% are in the leader group with low-risk exposure, and 40% of organizations are in between (the intermediate and advanced groups). Two key factors distinguish between the beginner and leader groups: (1) an internal factor, which is the Control Enablers; and (2) an external factor, which is the influence of a cyber regulating body. Our study confirms that Control Enablers in higher Tiers will help organizations achieve better cybersecurity performance (R = 0.98021) and highlights the significance of cyber regulating bodies by showing a shear difference of 197.53% in cyber performance between highly regulated and low-regulated industries. Conclusions: This research reveals key insights into the importance of Control Enablers, which are the internal factors that organizations must leverage to drive better cybersecurity performance, and the positive return on enforcement, which emphasizes the need for cyber regulating bodies. The CTI framework has proven to be valid and efficient for measuring cybersecurity performance. At the very least, a step-wise roadmap is provided for organizations and regulators to adopt and adapt the CTI framework for their cybersecurity measurement and improvement mission.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Information and Cyber Security · Network Security and Intrusion Detection · Cloud Data Security Solutions
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Faculty of Engineering, Mahidol University, Salaya 73170, Thailand
Center of Excellence in Management Research for Corporate Governance and Behavioral, Sasin School of Management, Chulalongkorn University, Bangkok 10330, Thailand
References (100+)
Show source-provided references
1. Cybersecurity as an Essential Sustainable Economic Development Factor10.14207/ejsd.2018.v7n4p171 ↗
2. Michael, K., Kobran, S., Abbas, R., and Hamdoun, S. (2019, January 15–16). Privacy, Data Rights and Cybersecurity: Technology for Good in the Achievement of Sustainable Development Goals. Proceedings of the International Symposium on Technology and Society (ISTAS2019), Boston, MA, USA.10.1109/ISTAS48451.2019.8937956 ↗
3. Andrade, R., Yoo, S., Tello-Oquendo, L., and Ortiz-Garces, I. (2021). Cybersecurity, Sustainability, and Resilience Capabilities of a Smart City, Elsevier.10.1016/B978-0-323-85151-0.00012-9 ↗
4. Sadik, S., Ahmed, M., Sikos, L., and Islam, N. (2020). Toward a Sustainable Cybersecurity Ecosystem. Computers, 9.10.3390/computers9030074 ↗
5. IBM Security (2021, January 20). Cost of a Data Breach Report 2020. Available online: https://www.ibm.com/security/digital-assets/cost-data-breach-report/.10.1016/S1361-3723(21)00082-8 ↗
6. (2020, August 12). Interpol, Cyber Crime: COVID-19 Impact. Available online: https://www.interpol.int/News-and-Events/News/2020/INTERPOL-report-shows-alarming-rate-of-cyberattacks-during-COVID-19.
7. Hill, T. (2020, August 12). FBI Sees Spike in Cyber Crime Reports during Coronavirus Pandemic. Available online: https://thehill.com/policy/cybersecurity/493198-fbi-sees-spike-in-cyber-crime-reports-during-coronavirus-pandemic.
8. Value conflicts for information security management10.1016/j.jsis.2011.06.001 ↗
9. (2013). Information Technology—Security Techniques—Information Security Management Systems—Requirements. Standard No. ISO/IEC 27001:2013.
10. (2019). Security Techniques—Extension to ISO/IEC 27001 and ISO/IEC 27002 for Privacy Information Management—Requirements and Guidelines. Standard No. ISO/IEC 27701:2019.
11. NIST (2020, May 05). Framework for Improving Critical Infrastructure Cybersecurity, Available online: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf.
12. Payment Card Industry Security Standards Council (2018). Payment Card Industry (PCI) Data Security Standard, PCI SSC.
13. A study of Effect of Information Security Management System [ISMS] Certification on Organization Performance
14. Can We Test Our Way Out of the COVID-19 Pandemic?10.1128/JCM.02225-20 ↗
15. Burke, W., Oseni, T., Jolfaei, A., and Gondal, I. (2019, January 29–31). Cybersecurity Indexes for eHealth. Proceedings of the Australasian Computer Science Week Multiconference, Sydney, Australia.10.1145/3290688.3290721 ↗
16. Prislan, K., Mihelič, A., and Bernik, I. (2020). A real-world information security performance assessment using a multidimensional socio-technical approach. PLoS ONE, 15.10.1371/journal.pone.0238739 ↗
17. Hewlett Packard (2021, May 28). State of Security Operations: Report of Capabilities and Maturity of Cyber Defense Organizations: Business White Paper. Palo Alto., Available online: https://ten-inc.com/presentations/HP-State-of-Security-Operations-2015.pdf.
18. A methodology to measure and monitor level of operational effectiveness of a CSOC10.1007/s10207-017-0365-1 ↗
19. John Joseph, A.J., and Mariappan, M. (2018). A novel trust-scoring system using trustability co-efficient of variation for identification of secure agent platforms. PLoS ONE, 13.10.1371/journal.pone.0201600 ↗
20. De Paz, J.F., Julian, V., Villarrubia, G., Marreiros, G., and Novais, P. (2017). Information Security Maturity Level: A Fast Assessment Methodology. Ambient Intelligence—Software and Applications—8th International Symposium on Ambient Intelligence (ISAmI 2017), Springer.10.1007/978-3-319-61118-1 ↗
21. Teufel, S., Burri, R., and Teufel, B. (2018). Cybersecurity guideline for the utility business a swiss approach. Proceedings of the 2018 International Conference on Smart Grid and Clean Energy Technologies, ICSGCE 2018, Kajang, Malaysia, 29 May–1 June 2018, IEEE.10.1109/ICSGCE.2018.8556819 ↗
22. Information security assessment in public administration10.1016/j.cose.2019.101709 ↗
23. What Is the Best Response Scale for Survey and Questionnaire Design; Review of Different Lengths of Rating Scale/Attitude, Scale Likert Scale
24. (2017). Systems and Software Engineering—Measurement Process. Standard No. ISO/IEC/IEEE 15939:2017.
25. U.S. Department of Energy (2021, May 28). Cybersecurity Capability Maturity Model Version 2.0, Available online: https://www.energy.gov/ceser/cybersecurity-capability-maturity-model-c2m2.
26. RSA (2016). RSA Cybersecurity Poverty Index—2016, RSA.
27. Tenable Network Security, and CyberEdge Group (2017). 2017 Global Cybersecurity Assurance Report Card, CyberEdge Group.
28. CAFISGO: A Capability Assessment Framework for Information Security Governance in Organizations
29. Bernik, I., and Prislan, K. (2016). Measuring Information Security Performance with 10 by 10 Model for Holistic State Evaluation. PLoS ONE, 11.10.1371/journal.pone.0163050 ↗
30. Defining a New Composite Cybersecurity Rating Scheme for SMEs in the U.K10.1007/978-3-030-34339-2_20 ↗
31. Ponemon Institute (2010). Security Effectiveness Framework Study, Ponemon Institute. Available online: https://www.yumpu.com/en/document/view/28533958/security-effectiveness-framework-study.
32. Cybersecurity and Infrastructure Security Agency (2021, May 28). Cyber Resilience Review, Available online: https://www.cisa.gov/uscert/resources/assessments.
33. ITU, and BDT (2020). Cyber Security Programme Global Cybersecurity Index (GCI) Reference Model, ITU/BDT.
34. E-Governance Academy (2018). National Cybersecurity Index, EGA.
35. PwC, and Iron Mountain (2014). An Introduction to the Information Risk Maturity Index, Iron Mountain.
36. Yu, S. (March, January 29). Understanding the Security Vendor Landscape Using the Cyber Defense Matrix. Proceedings of the RSA Conference, San Francisco, CA, USA.
37. Yu, S. (2019, January 4–8). The BETTER Cyber Defense Matrix, Reloaded. Proceedings of the RSA Conference, San Francisco, CA, USA.
38. Bissell, K., LaSalle, R., and Richards, K. (2017). The Accenture Security Index, Accenture.
39. Potential Problems with Information Security Risk Assessments
40. Software Engineering Institute (2016). CERT Resilience Management Model Version 1.2, SEI. Available online: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=508084.
41. Deciding on the scale granularity of response categories of likert type scales: The case of a 21-point scale
42. Effectiveness of Security Controls On Electronic Health Records
43. Tytarenko, O. (2017). Selection of the Best Security Controls for Rapid Development of Enterprise-Level Cyber Security, Naval Postgraduate School.
44. NIST (2020, May 05). NIST SP 800-53 Rev.4 Security and Privacy Controls for Federal Information Systems and Organizations, Available online: https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final.
45. Center for Internet Security (2020, October 08). CIS Controls v7.1. Available online: https://learn.cisecurity.org/CIS-Controls-v7.1.
46. SANS Institute (2020, October 08). The CIS Critical Security Controls for Effective Cyber Defense. Available online: https://www.sans.org/critical-security-controls.
47. Microsoft (2020, June 03). About the ENISA Information Assurance Framework. Available online: https://docs.microsoft.com/en-us/compliance/regulatory/offering-enisa.
48. OWASP (2020, November 09). OWASP Top Ten. Available online: https://owasp.org/www-project-top-ten/.
49. OWASP (2020, November 09). OWASP Mobile Top Ten. Available online: https://owasp.org/www-project-mobile-top-10/.
50. Krosnick, J. (2018). Question and Questionnaire Design. The Palgrave Handbook of Survey Research, Palgrave.10.1007/978-3-319-54395-6_53 ↗
51. Armitage, P., and Colton, T. (2005). Analytic Hierarchy Process. Encyclopedia of Biostatistics, John Wiley & Sons.10.1002/0470011815 ↗
52. Safari, M.R., and Yu, L.Z. (2014, January 1). Assessment of IT Governance and Process Maturity: Evidence from banking Industry. Proceedings of the Thirteenth Wuhan International Conference on E-Business, Wuhan, China.
53. Towards A Model of Maturity For Is Risk Management
54. Salvi, V., and Kadam, A.W. (2014). Information Security Management at HDFC Bank: Contribution of Seven Enablers, ISACA.
55. Da Veiga, A. (2015). The influence of information security policies on information security culture: Illustrated through a case study. Proceedings of the Ninth International Symposium on Human Aspects of Information Security & Assurance (HAISA), Levos, Greece, 1–3 July 2015, Plymouth University.
56. Situational Leadership and Cybersecurity10.1002/ltl.20409 ↗
57. Kianpour, M., Kowalski, S., Zoto, E., Frantz, C., and Overby, H. (2019, January 17–19). Designing Serious Games for Cyber Ranges: A Socio-technical Approach. Proceedings of the 2019 IEEE European Symposium on Security and Privacy Workshops, Stockholm, Sweden.10.1109/EuroSPW.2019.00016 ↗
58. Griffy-Brown, C., Lazarikos, D., and Chun, M. (July, January 28). Agile Business Growth and Cyber Risk: How do we secure the Internet of Things (IoT) environment?. Proceedings of the 2018 IEEE Technology and Engineering Management Conference (TEMSCON), Evanston, IL, USA.10.1109/TEMSCON.2018.8488397 ↗
59. Sharma, L., and Singh, V. (2020, January 27). India towards digital revolution (security and sustainability). Proceedings of the 2nd World Conference on Smart Trends in Systems, Security and Sustainability World, London, UK.
60. Moller, D. (2020). Cybersecurity in Digital Transformation Scope and Applications, Springer.10.1007/978-3-030-60570-4 ↗
61. Patching security governance: An empirical view of emergent governance mechanisms for cybersecurity
62. Challenges for organizational structure and design as a result of digitalization and cybersecurity10.24052/BMR/V11NU01/ART-29 ↗
63. NIST (2021, July 11). NIST SP 800-181. Rev.1 Workforce Framework for Cybersecurity (NICE Framework). Available online: https://doi.org/10.6028/NIST.SP.800-181r1.10.6028/NIST.SP.800-181r1 ↗
64. Elkhannoubi, H., and Belaissaoui, M. (2016, January 14–16). A framework for an effective cybersecurity strategy implementation: Fundamental pillars identification. Proceedings of the International Conference on Intelligent Systems Design and Applications (ISDA), Porto, Portugal.10.1109/ISDA.2015.7489156 ↗
65. Akin, O., and Karaman, M. (2013, January 23–24). A novel concept for cybersecurity: Institutional cybersecurity. Proceedings of the International Conference on Information Security and Cryptography, Ankara, Turkey.
66. Chehri, A., Fofona, I., and Yang, X. (2021). Security Risk Modeling in Smart Grid Critical Infrastructures in the Era of Big Data and Artificial Intelligence. Sustainability, 6.10.3390/su13063196 ↗
67. Security Automation in Information Technology
68. Geluvaraj, B. (2018). The Future of Cybersecurity: Major Role of Artificial Intelligence, Machine Learning, and Deep Learning in Cyberspace. International Conference on Computer Networks and Communication Technologies (ICCNCT), Springer.10.1007/978-981-10-8681-6_67 ↗
69. Truong, T., Diep, Q., and Zelinka, I. (2020). Artificial Intelligence in the Cyber Domain: Offense and Defense. Symmetry, 3.10.3390/sym12030410 ↗
70. Shaukat, K., Luo, S., Varadharajan, V., Hameed, I.A., Chen, S., Liu, D., and Li, J. (2020). Performance Comparison and Current Challenges of Using Machine Learning Techniques in Cybersecurity. Energies, 13.10.3390/en13102509 ↗
71. Sarker, I., Abushark, Y., Alsolami, F., and Khan, A. (2020). IntruDTree: A Machine Learning Based Cyber Security Intrusion Detection Model. Symmetry, 5.10.20944/preprints202004.0481.v1 ↗
72. Krumay, B., Bernroider, E.W., and Walser, R. (2018, January 28–30). Evaluation of Cybersecurity Management Controls and Metrics of Critical Infrastructures: A Literature Review Considering the NIST Cybersecurity Framework. Proceedings of the 23rd Nordic Conference (NordSec 2018), Oslo, Norway.10.1007/978-3-030-03638-6_23 ↗
73. A Framework for the Evaluation of Trainee Performance in Cyber Range Exercises10.1007/s11036-019-01442-0 ↗
74. Expert assessment of organizational cybersecurity programs and development of vignettes to measure cybersecurity countermeasures awareness10.36965/OJAKM.2018.6(1)67-80 ↗
75. Ahmed, Y., Naqvi, S., and Josephs, M. (2019, January 8–10). Cybersecurity Metrics for Enhanced Protection of Healthcare IT Systems. Proceedings of the International Symposium on Medical Information and Communication Technology (ISMICT), Oslo, Norway.10.1109/ISMICT.2019.8744003 ↗
76. Quantitative Metrics and Risk Assessment: The Three Tenets Model of Cybersecurity10.22215/timreview/712 ↗
77. De Bruin, R., and Solms, V. (2016, January 11–13). Cybersecurity Governance: How can we measure it?. Proceedings of the IST Africa Conference, Durban, South Africa.10.1109/ISTAFRICA.2016.7530578 ↗
78. Andreasson, A., and Fallen, N. (2018, January 24–26). External Cybersecurity Incident Reporting for Resilience. Proceedings of the 17th International Conference of Perspectives in Business Informatics Research (BIR 2018), Stockholm, Sweden.10.1007/978-3-319-99951-7_1 ↗
79. Investors’ perceptions of the cybersecurity risk management reporting framework10.1108/IJAIM-02-2019-0022 ↗
80. Creating Cybersecurity Knowledge Graphs From Malware After Action Reports10.1109/ACCESS.2020.3039234 ↗
81. Quick, simple and reliable: Forced binary survey questions10.2501/IJMR-53-2-231-252 ↗
82. Conditional Branching in Computerized Self-Administered Questionnaires on the World Wide Web10.1177/154193120204601401 ↗
83. National Cybersecurity Agency (NCSA) (2021, June 06). Prescribing Criteria and Types of Organizations with Tasks or Services as Critical Information Infrastructure Organizations and Assigning Control and Regulation B.E. 2564. Available online: https://drive.ncsa.or.th/s/akWsCmQ7Z9oDWAY.
84. Kline, R.B. (2010). Principles and Practice of Structural Equation Modeling, The Guilford Press.
85. Hair, J., Black, W., Babin, B., and Anderson, R. (2010). Multivariate Data Analysis: A Global Perspective, Prentice Hall.
86. George, D., and Mallery, P. (2003). SPSS for Windows Step by Step: A Simple Guide and Reference, 11.0 Update, Allyn & Bacon. [4th ed.].
87. McKinsey & Company (2022, July 14). Organizational Cyber Maturity: A Survey of Industries. Available online: https://www.mckinsey.com/business-functions/risk-and-resilience/our-insights/organizational-cyber-maturity-a-survey-of-industries.
88. The Correlation Coefficient: An Overview10.1080/10408340500526766 ↗
89. Assessing cybersecurity maturity of organizations: An empirical investigation in the Indian context10.1080/19393555.2019.1689318 ↗
90. A Literature Review on Platform Business Model: The Impact of Technological Processes on Platform Business
91. Digital platform-based business models—An exploration of critical success factors10.1016/j.jengtecman.2021.101625 ↗
92. Wu, J. (2012). Cluster Analysis and K-means Clustering: An Introduction. Advances in K-Means Clustering, Springer.10.1007/978-3-642-29807-3 ↗
93. Cyber security: Between challenges and prospects
94. Identity Management Capability Powered by Artificial Intelligence to Transform the Way User Access Privileges Are Managed, Monitored and Controlled
95. Best Practices for Securing Financial Data and PII in Public Cloud
96. Ministry of Digital Economy and Society (2022, October 15). Computer-Related Crime Act B.E. 2550. Available online: https://www.mdes.go.th/law/detail/3618-COMPUTER-RELATED-CRIME-ACT-B-E--2550--2007-.
97. J.P. Morgan (2022, October 15). E-Commerce Payments Trends: Thailand. Available online: https://www.jpmorgan.com/merchant-services/insights/reports/thailand.
98. Alotaibi, B., and Almagwashi, H. (2018, January 4–6). A Review of BYOD Security Challenges, Solutions and Policy Best Practices. Proceedings of the 2018 1st International Conference on Computer Applications & Information Security (ICCAIS), Riyadh, Saudi Arabia.10.1109/CAIS.2018.8441967 ↗
99. Koo, J., Kang, G., and Kim, Y.-G. (2020). Security and Privacy in Big Data Life Cycle: A Survey and Open Challenges. Sustainability, 12.10.3390/su122410571 ↗
100. Moulos, V., Chatzikyriakos, G., Kassouras, V., Doulamis, A., Doulamis, N., Leventakis, G., Florakis, T., Varvarigou, T., Mitsokapas, E., and Kioumourtzis, G. (2018). A Robust Information Life Cycle Management Framework for Securing and Governing Critical Infrastructure Systems. Inventions, 3.10.3390/inventions3040071 ↗