Abstract
Cybersecurity concerns are one of the significant side effects of an increasingly interconnected world, which inevitably put economic factors into perspective, either directly or indirectly. In this context, it is imperative to understand the significant dependencies between complex and distributed systems (e.g., supply-chain), as well as security and safety risks associated with each actor. This paper proposes SEConomy, a strictly step-based framework to measure economic impact of cybersecurity activities in a distributed ecosystem with several actors. Through the mapping of actors, responsibilities, inter-dependencies, and risks, it is possible to develop specific economic models, which can provide in a combined manner an accurate picture of cybersecurity economic impacts.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
Non-profit organization serving military, government, industry, and academia.
References
AFCE: The Economics of Cybersecurity: A Practical Framework for Cybersecurity Investment. The AFCE Cyber Committee (2013). https://www.afcea.org/committees/cyber/documents/cybereconfinal.pdf
Bauer, J., Van Eeten, M.: Introduction to the economics of cybersecurity. Commun. Strat. 81, 13–22 (2011)
BBC: Boeing Admits It ‘Fell Short’ on Safety Alert for 737, pp. 1–3. BBC News (2019). https://www.bbc.com/news/business-48461110
Böhme, R.: Security metrics and security investment models. In: Echizen, I., Kunihiro, N., Sasaki, R. (eds.) IWSEC 2010. LNCS, vol. 6434, pp. 10–24. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-16825-3_2
Brecht, M., Nowey, T.: A closer look at information security costs. In: Böhme, R. (ed.) The Economics of Information Security and Privacy, pp. 3–24. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-39498-0_1
Chen, P.Y., Kataria, G., Krishnan, R.: Correlated failures, diversification, and information security risk management. MIS Q. 35, 397–422 (2011)
Dynes, S., Goetz, E., Freeman, M.: Cyber security: are economic incentives adequate? In: Goetz, E., Shenoi, S. (eds.) ICCIP 2007. IIFIP, vol. 253, pp. 15–27. Springer, Boston (2008). https://doi.org/10.1007/978-0-387-75462-8_2
Felici, M., Wainwright, N., Cavallini, S., Bisogni, F.: What’s new in the economics of cybersecurity? IEEE Secur. Priv. 14, 11–13 (2016). https://doi.org/10.1109/MSP.2016.64
Garg, P., Kohnfelder, L.: The threat to our products, pp. 1–8. Microsoft (1999). https://adam.shostack.org/microsoft/The-Threats-To-Our-Products.docx
Gordon, L.A., Loeb, M.P.: The economics of information security investment. ACM Trans. Inf. Syst. Secur. 5, 438–457 (2002). https://doi.org/10.1145/581271.581274
Horng, T.C.: A comparative analysis of supply chain management practices by Boeing and Airbus: long-term strategic implications. Master thesis, Massachusetts Institute of Technology (MIT) (2006)
Jentzsch, N.: State-of-the-Art of the Economics of Cyber-Security and Privacy, vol. 4. IPACSO Deliverable D4.1 (2016)
Kornecki, A.J., Hall, K.: Approaches to assure safety in fly-by-wire systems: Airbus vs. Boeing. In: IASTED Conference on Software Engineering and Applications (2004)
Maglaras, L.A., et al.: Cyber security of critical infrastructures. ICT Express 4, 42–45 (2018). https://doi.org/10.1016/j.icte.2018.02.001. http://www.sciencedirect.com/science/article/pii/S2405959517303880. SI: CI and Smart Grid Cyber Security
McGuffin, C., Mitchell, P.: On domains: cyber and the practice of warfare. Int. J.: Can. J. Glob. Policy Anal. 69, 394–412 (2014)
Moore, S.: Gartner Forecasts Worldwide Information Security Spending to Exceed 124 Billion in 2019. Gartner (2018). https://www.gartner.com/en/newsroom/press-releases/2018-08-15-gartner-forecasts-worldwide-information-security-spending-to-exceed-124-billion-in-2019
Moore, T.: The economics of cybersecurity: principles and policy options. Int. J. Crit. Infrastruct. Prot. (IJCNIP) 3, 103–117 (2010). https://doi.org/10.1016/j.ijcip.2010.10.002. http://www.sciencedirect.com/science/article/pii/S1874548210000429
Morgan, S.: 2019 Official Annual Cybercrime Report. Herjavec Group (2019). https://bit.ly/2TouUT2
NIST: Security and Privacy Controls for Federal Information Systems and Organizations, vol. 800, pp. 8–13. National Institute of Standards and Technology (NIST) Special Publication (2013)
NIST: Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. Technical report, National Institute of Standards and Technology (NIST) (2014)
Rich, E., Gonzalez, J.J., Qian, Y., Sveen, F.O., Radianti, J., Hillen, S.: Emergent vulnerabilities in integrated operations: a proactive simulation study of economic risk. Int. J. Crit. Infrastruct. Prot. 2, 110–123 (2009). https://doi.org/10.1016/j.ijcip.2009.07.002. http://www.sciencedirect.com/science/article/pii/S1874548209000183
Robert, S., Vijay, T., Tim, Z.: Best Practices in Cyber Supply Chain Risk Management, pp. 1–14. US Resilience Project (2016)
Shostack, A.: Experiences Threat Modeling at Microsoft, pp. 1–11. Microsoft (2008). https://adam.shostack.org/modsec08/Shostack-ModSec08-Experiences-Threat-Modeling-At-Microsoft.pdf
Sonnenreich, W., Albanese, J., Stout, B., et al.: Return on security investment (ROSI)-a practical quantitative model. J. Res. Pract. Inf. Technol. 38, 45–52 (2006)
Takagi, T., Sugeno, M.: Fuzzy identification of systems and its applications to modeling and control. In: Readings in Fuzzy Sets for Intelligent Systems, pp. 387–403. Elsevier (1993)
Wang, H.O., Tanaka, K., Griffin, M.F.: An approach to fuzzy control of nonlinear systems: stability and design issues. IEEE Trans. Fuzzy Syst. 4, 14–23 (1996)
WhiteHouse: The Cost of Malicious Cyber Activity to the U.S. Economy. White House (2018). https://www.whitehouse.gov/wp-content/uploads/2018/03/The-Cost-of-Malicious-Cyber-Activity-to-the-U.S.-Economy.pdf
Wuyts, K., Scandariato, R., Joosen, W., Deng, M., Preneel, B.: LINDDUN: a privacy threat analysis framework, pp. 1–23. DistriNet (2019). https://people.cs.kuleuven.be/~kim.wuyts/LINDDUN/LINDDUN.pdf
Acknowledgements
This paper was supported partially by (a) the University of Zürich UZH, Switzerland and (b) the European Union’s Horizon 2020 Research and Innovation Program under grant agreement No. 830927, the Concordia project.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2019 Springer Nature Switzerland AG
About this paper
Cite this paper
Rodrigues, B., Franco, M., Parangi, G., Stiller, B. (2019). SEConomy: A Framework for the Economic Assessment of Cybersecurity. In: Djemame, K., Altmann, J., Bañares, J., Agmon Ben-Yehuda, O., Naldi, M. (eds) Economics of Grids, Clouds, Systems, and Services. GECON 2019. Lecture Notes in Computer Science(), vol 11819. Springer, Cham. https://doi.org/10.1007/978-3-030-36027-6_13
Download citation
DOI: https://doi.org/10.1007/978-3-030-36027-6_13
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-36026-9
Online ISBN: 978-3-030-36027-6
eBook Packages: Computer ScienceComputer Science (R0)