There are security implications that result from our incorporating computer automation, or cyber, into business systems and industrial control systems that underpin almost everything we do. Assessing these cyber systems, to ensure resilience, is performed through a number of well‐known frameworks to develop an initial understanding, or baseline, of our current system security levels.

Assessments often begin with an asset prioritization, a “Crown Jewels Analysis¹” (MITRE) being one example, with more detailed evaluations developed from this initial structure. Figure 2.1 provides an example “Enterprise Risk Analysis” structuring designed to perform this high‐level prioritization, with detailed process modeling showing system dependencies for structural evaluation. Component‐level assessment, or penetration testing, is then used at the technology level to inventory the system’s architecture.

As shown in Figure 2.1, network evaluation spans from an overall key asset prioritization to specific network components. This can include using dependency or attack graphs, during process modeling, to highlight specific scenarios.

2.1 Assessment Frameworks

The standard Confidentiality, Integrity, and Availability (CIA) information security triad, complimented by subject matter expertise and proven use cases, provides a foundation for computer defense operations.

2.2 NIST 800 Risk Framework

The standard NIST SP 800‐30 is used for baseline cyber system security evaluation (Table 2.1).

Table 2.1’s risk descriptions attempt to capture all of the issues and inconveniences that characterize the precursors of a training event for cyber planning. These are items that help with “designing in” cyber‐protective measures during the development process. For example, there are two primary ways (Gelbstein 2013) to look at current information enterprise analysis:

1. Business Impact Analysis (BIA) – used for incident response, BIA is quantifiable, relies on credible data, and drives crisis management, including disaster recovery and business continuity:
   1. MITRE Crown Jewels Analysis
2. Enterprise Risk Management (ERM) – used for incident forecasting is a challenge to quantify, relies on assumptions and drives mitigation plans, the risk register and the return on security investment (ROSI) calculation:
   1. NIST Cybersecurity Framework (CSF)
   2. Risk Management Framework (RMF)
   3. ISO 31000
   4. ISI 27000 series

Figure 2.2 shows how assessment and management approaches are used to help define business impact and enterprise risk analysis categories for information system evaluation.

As shown in Figure 2.2, information security assessment can take the form of business impact or enterprise risk analysis. In addition, taxonomy information is provided by both the Factor Analysis of Information Risk (FAIR) model (Jones 2005) and the NIST CSF, in further defining the terms used in implementing relevant security policy. Each of the frameworks is designed to improve system security, in the familiar resilience steps² of:

• Identify
• Prevent
• Detect
• Respond
• Reconstitute

Using the “conceptual model” provided by the standard steps of resilience provides the modeler with an approach for modeling cyber defense processes. In addition, this “conceptual model” compliments the standard maturity model assessment.

2.3 Cyber Insurance Approaches

In 2015, the Lloyd’s of London study, “Business Blackout,” (Maynard and Beecroft 2015) showed a potential 93 million Americans, across 10 states and the District of Columbia, without power due to a cyberattack; costing an estimated $243 billion; $1 trillion in the most stressing scenario (Figure 2.3).

One reason to look at insurance analyses is because insurers necessarily deal with the “as is,” real, world, where clients want to transfer their cyber risk through an insurance policy. Reading the appendices of “Business Blackout” (Maynard and Beecroft 2015), there was noticeable variety in

• Countries attacked
• Facilities attacked
• Types of attackers
• Attacker technologies
• Attack effects

In addition, “Business Blackout” provides a picture that almost any vulnerability is liable to be exploited – a wake‐up call as to what is possible. Expanding on insurance modeling as a template for describing cyber risk, Bohme and Schwartz (2010) provide an excellent background of cyber insurance literature and define a unified model of cyber insurance (i.e. cyber risk description) that consists of five components:

• the networked environment
• demand side
• supply side
• information structure
• organizational environment

First, the network topology plays a key role in affecting both security dependencies and failure correlations. For example, independent computers versus a fully connected computing network, two topology extremes, will result in vastly different security assessment and implementation challenges. In addition, system impacts will look very different, should a successful attack occur.

An additional insurance consideration includes using models of the defended network, potential impact, and defense cost estimates for both resilience and potential asset loss.³ One challenge is for cyber insurance companies to price their offerings. Pricing can correlate to risk (Black and Scholes 1973), providing a view as to how well an insurance company believes it understands cyber risk. A recent study (Sasha Romanosky) looks at how insurers do business by evaluating several policies to see how companies evaluate risk. In regard to pricing, or rate schedules, there is a surprising variation in the sophistication of the equations and metrics used to price premiums. Many of the policies examined used a very simple, flat rate pricing (based simply on expected loss), while other policies use more parameters, such as the firm’s asset value (or firm revenue), or standard insurance metrics (e.g. limits, retention, and coinsurance), and industry type. More sophisticated policies include specific information security controls and practices as collected from the security questionnaires.

The seemingly capricious pricing model of cyber insurance is partially due to the seemingly random demand signal that current cyberattacks provide. We are in a new era, with nefarious cyber actors ranging from States to anonymous hackers, where the loss process that an insurance company constructs can only really be based on the business process value at risk⁴ (Sasha Romanosky).

2.3.1 An Introduction to Loss Estimate and Rate Evaluation for Cyber

In performing quantitative risk assessment, insurance companies often use some form of an a single security incident, with the annualized loss expectancy (ALE) to justify the cost of implementing countermeasures to protect an asset. This may be calculated by multiplying the single loss expectancy (SLE), which is the loss of value based on a single security incident, with the annualized rate of occurrence (ARO), which is an estimate of how often a threat would be successful in exploiting a vulnerability (Equation 2.1).

Equation 2.1: Annualized loss expectancy

In addition to traditional insurance assessment approaches, the FAIR model is an international standard⁵ for computing value at risk, and is a practical framework for understanding, measuring, and assessing information risk, enabling well‐informed decision making. In addition, the FAIR model is supported by a tool (i.e. Risk Lens) and a community for quantifying and managing cyber risk. In addition to the FAIR model, Douglas Hubbard’s “How to measure anything in cyber security risk” (Hubbard et al. 2016) provides background on cyber measurement approaches, along computer‐based approaches,⁶ for demystifying cyber issues.

2.4 Conclusions

Insurance modeling is used here to provide a baseline for the “as is” of cyber security assessment. While assessments will leverage standard frameworks (e.g. NIST CSF) and risk evaluation approaches (e.g. ISO 31000 based), their goal of estimating system cyber resilience is the same. Leveraging maturity models is used to determine defensive capability across the respective lines of effort, providing a comprehensive approach for understanding an organization’s current cyber security posture.

2.5 Future Work

In addition to the assessment frameworks and tools reviewed here, DoDAF architecture frameworks are an additional tool for documenting systems for cyber security evaluation (Hamilton, 2013; Richards 2014). Leveraging system understanding, through DoDAF architectures, along with threat evaluation, was recently done in a US Air Force system assessment approach (Jabbour and Poisson 2016).

2.6 Questions