Multicriteria Decision Framework for Cybersecurity Risk Assessment and Management

TLDR

Risk assessors and managers confront numerous challenges from the constantly evolving nature of cyber systems, their spread across physical, information, and sociocognitive domains, and the complex network structures that can involve thousands of nodes. The authors review risk‑based decision‑making techniques, find that they typically omit full coverage of threat, vulnerability, and consequence and lack cross‑domain integration, and propose a decision‑analysis framework that quantifies these components to bridge risk assessment and management. They develop a decision‑analysis method that quantifies threat, vulnerability, and consequence through a set of criteria and demonstrate it on a realistic case study ranking five cybersecurity enhancement strategies. The framework provides a structured, transparent process for selecting risk‑management alternatives that align with stakeholder values and technical data, though it does not eliminate inherent biases.

Abstract

Abstract Risk assessors and managers face many difficult challenges related to novel cyber systems. Among these challenges are the constantly changing nature of cyber systems caused by technical advances, their distribution across the physical, information, and sociocognitive domains, and the complex network structures often including thousands of nodes. Here, we review probabilistic and risk‐based decision‐making techniques applied to cyber systems and conclude that existing approaches typically do not address all components of the risk assessment triplet (threat, vulnerability, consequence) and lack the ability to integrate across multiple domains of cyber systems to provide guidance for enhancing cybersecurity. We present a decision‐analysis‐based approach that quantifies threat, vulnerability, and consequences through a set of criteria designed to assess the overall utility of cybersecurity management alternatives. The proposed framework bridges the gap between risk assessment and risk management, allowing an analyst to ensure a structured and transparent process of selecting risk management alternatives. The use of this technique is illustrated for a hypothetical, but realistic, case study exemplifying the process of evaluating and ranking five cybersecurity enhancement strategies. The approach presented does not necessarily eliminate biases and subjectivity necessary for selecting countermeasures, but provides justifiable methods for selecting risk management actions consistent with stakeholder and decisionmaker values and technical data.