Return On Cyber Security Investment (ROCSI)

为了具有商业价值，任何投资都必须是有选择性的，并集中在业务的高优先级领域。然而，由于董事会无法充分理解和预测网络威胁的直接和间接影响，他们很难证明网络安全的投资成本和投资回报率是合理的。根本问题在于，缺乏将网络威胁纳入董事会有关网络安全投资决策的透明途径。在投资决策中，组织需要确定威胁是否会显现对业务的影响，计算直接成本（例如网络威胁缓解、网络保险费用）和间接成本（例如对系统性能的影响、股价下跌），以优化组织的安全防御能力。关键决策者是安全经理（例如CISO）和董事会成员。然而，他们发现很难估计投资成本，并将这些成本与获得的潜在利益或减轻的影响进行平衡，因为网络安全投资可以防止潜在损失，但可能不会直接产生收入。目前还缺乏将网络威胁缓解与网络安全投资回报率联系起来的明确方式。由于不断变化的威胁环境和业务环境（例如向系统中添加设备或更改威胁缓解决策）而产生的不确定性使情况更加复杂。拟议的ROCSI旨在通过从多个威胁来源全面捕获威胁数据并将其集成到网络安全投资决策过程中来应对这些挑战。ROCSI旨在提供威胁信息，用户定制和最新的决策支持，并随着新的威胁数据的出现而不断更新。ROCSI将根据决策者排序的业务流程输出关于威胁缓解的ROI分析。该项目将结合多学科数据和人为因素，为董事会和战略层面的网络安全决策新方法奠定基础，以提高决策的透明度和质量。它将通过研究董事会和战略层面的威胁知情决策，为国家网络安全战略做出贡献，目的是增强组织的网络防御能力，提高组织的应变能力。它通过激励董事会和机构积极投资于网络安全并采取积极的安全行为，解决了NCSC研究问题手册的主题“激励与行为”。拟议的研究属于全球不确定性主题，其中网络安全被列为优先事项。基于PI之前与NCSC、RITICS、RISCS、Innovate UK的合作，以及PI已建立的联系人，该项目处于一个独特的位置，可以在研究界和行业中产生影响，这些联系人将帮助形成、评估和完善拟议的研究。该项目独特地受益于主办组织在人类决策（LUCID研究实验室）和行为科学（ESRC资助NIBS）研究方面的良好记录，以及与NCSC， GCHQ， Dstl和Horizon DER研究所的合作伙伴关系，使研究成果得到最广泛的传播和利用。

To be of business value, any investment must be selective and focus on high priority areas of the business. However, boards find it difficult to justify the cost of investment and formulate ROI arguments on cyber security due to their inability to fully understand and anticipate the direct and indirect impact of cyber threats. The fundamental problem is the absence of transparent ways of integrating cyber threats into the boards' decisions about investment in cyber security. In an investment decision, organisations are required to determine business impact if the threats were to manifest, calculate the direct cost (e.g. cyber threat mitigations, cyber insurance charges) and indirect cost (e.g. impact on system performance, share price drop) to optimise the organisation's security defence capability. The key decision makers are security managers (e.g. CISO) and board members. However, they find it difficult to estimate the costs of investing and balancing these against potential benefits procured or impacts mitigated as the cyber security investments prevent potential losses but may not generate revenue directly. There is a lack of a clear way of linking cyber threat mitigations to the cyber security ROI. This is compounded by the uncertainties resulting from the changing threat landscape and business context (e.g. adding devices to the system or changing of threat mitigation decisions). The proposed ROCSI is designed to address these challenges by comprehensively capturing threat data from multiple threat sources and integrating it into the cyber security investment decision processes. The ROCSI aims to deliver threat-informed, user-tailored and up-to-date decision support which is continuously updated as new threat data becomes available. The ROCSI will output the ROI analysis on threat mitigations in response to the business processes ranked by decision makers.This project will deliver the foundations for a novel approach to cyber security decision making at the board and strategic level through combining multidisciplinary data and human factors to improve the transparency and quality of decision making. It will contribute to the national strategy on cyber security through the research of threat-informed decision making at the board and strategic level, with the aim of enhancing organisations' cyber defence capability and improve organisational resilience. It addresses the theme "Incentives and behaviours" of the NCSC Research Problem Book, through incentivising boards and organisations to proactively invest into cyber security and adopt positive security behaviours. The proposed research sits in the Global Uncertainties theme, where Cyber Security is listed as a priority. This project is in a unique position to deliver impact in both research communities and industries based on the PI's previous engagement with NCSC, RITICS, RISCS, Innovate UK, and the PI's established contacts who will help shape, evaluate and refine the proposed research. this project uniquely benefits from the host organisation's strong track record in human decision making (the LUCID research lab) and behaviour science (the ESRC funded NIBS) research, its partnership with NCSC, GCHQ, and Dstl and the Horizon DER Institute that enables the widest dissemination and exploitation of research outcomes.