SoK: Quantifying Cyber Risk
SoK: Quantifying Cyber Risk
复制标题
SoK：量化网络风险
DOI：
10.1109/sp40001.2021.00053
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Rainer Böhme
中科院分区：
文献类型：
--
作者：
Daniel W. Woods;Rainer Böhme
本文介绍了一种受结构方程模型启发的因果模型，该模型根据使用自反指标测量的潜在因素来解释网络风险结果。首先，我们使用该模型对实证性网络危害研究进行分类。我们发现，就典型或极端损失而言，网络危害并非异常。数据泄露频率的增加存在争议，并且随着时间的推移，股票市场对网络事件的反应造成的损害越来越小。仅仅关注危害会滋生宿命论；因果模型在评估安全干预措施的有效性方面最为有用。我们展示了简单的统计关系如何导致虚假结果，即更多的安全支出或应用更新与更高的受损率相关联。在考虑威胁和暴露因素时，安全指标被证明是解释受损率差异的重要因素，尤其是当研究使用多个安全水平指标时。
This paper introduces a causal model inspired by structural equation modeling that explains cyber risk outcomes in terms of latent factors measured using reflexive indicators. First, we use the model to classify empirical cyber harm studies. We discover cyber harms are not exceptional in terms of typical or extreme losses. The increasing frequency of data breaches is contested and stock market reactions to cyber incidents are becoming less damaging over time. Focusing on harms alone breeds fatalism; the causal model is most useful in evaluating the effectiveness of security interventions. We show how simple statistical relationships lead to spurious results in which more security spending or applying updates are associated with greater rates of compromise. When accounting for threat and exposure, indicators of security are shown to be important factors in explaining the variance in rates of compromise, especially when the studies use multiple indicators of the security level.
衡量安全实践及其对安全的影响
DOI：
10.1145/3355369.3355571
发表时间：
2019
期刊：
Proceedings of the Internet Measurement Conference (IMC'19
影响因子：
--
作者：
DeKoven, Louis F.;Randall, Audrey;Mirian, Ariana;Akiwate, Gautam;Blume, Ansel;Saul, Lawrence K.;Schulman, Aaron;Voelker, Geoffrey M.;Savage, Stefan
通讯作者：
Savage, Stefan
影响因子：
3.9
作者：
Levy, Karen;Schneier, Bruce
通讯作者：
Schneier, Bruce
DOI：
10.1145/3319535.3363195
发表时间：
2019-11
期刊：
Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security
影响因子：
--
作者：
Sazzadur Rahaman;Gang Wang;D. Yao
通讯作者：
Sazzadur Rahaman;Gang Wang;D. Yao