University of Virginia, Department of Systems and Information Engineering, Charlottesville, VA, USA.
U.S. Army Engineer Research & Development Center, Contractor, Concord, MA, USA.
Risk Anal. 2020 Jan;40(1):183-199. doi: 10.1111/risa.12891. Epub 2017 Sep 5.
Risk assessors and managers face many difficult challenges related to novel cyber systems. Among these challenges are the constantly changing nature of cyber systems caused by technical advances, their distribution across the physical, information, and sociocognitive domains, and the complex network structures often including thousands of nodes. Here, we review probabilistic and risk-based decision-making techniques applied to cyber systems and conclude that existing approaches typically do not address all components of the risk assessment triplet (threat, vulnerability, consequence) and lack the ability to integrate across multiple domains of cyber systems to provide guidance for enhancing cybersecurity. We present a decision-analysis-based approach that quantifies threat, vulnerability, and consequences through a set of criteria designed to assess the overall utility of cybersecurity management alternatives. The proposed framework bridges the gap between risk assessment and risk management, allowing an analyst to ensure a structured and transparent process of selecting risk management alternatives. The use of this technique is illustrated for a hypothetical, but realistic, case study exemplifying the process of evaluating and ranking five cybersecurity enhancement strategies. The approach presented does not necessarily eliminate biases and subjectivity necessary for selecting countermeasures, but provides justifiable methods for selecting risk management actions consistent with stakeholder and decisionmaker values and technical data.
风险评估人员和管理人员在面对新型网络系统时面临着许多困难的挑战。这些挑战包括技术进步导致的网络系统的不断变化的性质、它们在物理、信息和社会认知领域的分布，以及通常包括数千个节点的复杂网络结构。在这里，我们回顾了应用于网络系统的概率和基于风险的决策技术，并得出结论，现有方法通常不能解决风险评估三元组（威胁、脆弱性、后果）的所有组成部分，并且缺乏跨网络系统的多个领域进行集成的能力，无法为增强网络安全提供指导。我们提出了一种基于决策分析的方法，通过一组旨在评估网络安全管理替代方案总体效用的标准来量化威胁、脆弱性和后果。所提出的框架弥合了风险评估和风险管理之间的差距，允许分析师确保选择风险管理替代方案的结构化和透明过程。该技术的使用通过一个假设但现实的案例研究来说明，该案例研究说明了评估和排名五种网络安全增强策略的过程。所提出的方法不一定消除选择对策所需的偏见和主观性，但提供了合理的方法来选择与利益相关者和决策者的价值观和技术数据一致的风险管理行动。
