Multiple cybersecurity risk assessment and root cause analysis methods propose incident data as a source of information. However, it is not a straightforward matter to apply incident data in risk assessments. The paper trail of incident data is often incomplete, ambiguous, and dependent on the incident handlers routines for keeping records. Current incident classification approaches classify incidents as one specific type, for example, “Data spillage,” “Compromised information,” or “Hacking.” Through incident analysis, we found that the current classification schemes are ambiguous and that most incident consists of additional components. This paper builds on previous work on incident classifications and proposes a method for quantifying and risk analyzing incident data for improving decision-making. The applied approach uses a set of incident data to derive the causes, outcomes, and frequencies of risk events. The data in this paper was gathered from a year of incident handling from a Scandinavian university’s security operations center (SOC), and consists of 550 handled incidents from November 2016 to October 2017. By applying the proposed method, this paper offers empirical insight into the risk frequencies of the University during the period. We demonstrate the utility of the approach by deducting the properties of the most frequent risks and creating graphical representations of risks using a bow-tie diagram. The primary contribution of this paper is the highlighting of the ambiguity of existing incident classification methods and how to address it in risk quantification. Additionally, we apply the data in risk analysis to provide insight into common cyber risks faced by the University during the period. A fundamental limitation is that this study only defines adverse outcomes and does not include consequence estimates.
[1]
Ray Hunt,et al.
A taxonomy of network and computer attacks
,
2005,
Comput. Secur..
[2]
Karin Bernsmed,et al.
Visualizing Cyber Security Risks with Bow-Tie Diagrams
,
2017,
GraMSec@CSF.
[3]
Benjamin Edwards,et al.
Hype and Heavy Tails: A Closer Look at Data Breaches
,
2016,
WEIS.
[4]
Douglas W. Hubbard,et al.
How to Measure Anything in Cybersecurity Risk
,
2016
.
[5]
Einar Snekkenes,et al.
A framework for estimating information security risk assessment method completeness
,
2017,
International Journal of Information Security.
[6]
Cormac Herley,et al.
Sex, Lies and Cyber-Crime Surveys
,
2011,
WEIS.
[7]
Sasha Romanosky,et al.
Examining the costs and causes of cyber incidents
,
2016,
J. Cybersecur..
[8]
Marshall A. Kuypers,et al.
An Empirical Analysis of Cyber Security Incidents at a Large Organization
,
2016
.
[9]
Gaute Wangen,et al.
The Role of Malware in Reported Cyber Espionage: A Review of the Impact and Mechanism
,
2015,
Inf..
[10]
Bruce Potter.
Practical Threat Modeling
,
2016,
login Usenix Mag..
[11]
Maria Kjaerland,et al.
A taxonomy and comparison of computer security incidents from the commercial and government sectors
,
2006,
Comput. Secur..
[12]
Andrii Shalaginov,et al.
Cyber Security Risk Assessment of a DDoS Attack
,
2016,
ISC.
[13]
Gaute Wangen,et al.
Empirical Case Studies of the Root Cause Analysis Method in Information Security
,
2018
.