NSF-BSF: SaTC: CORE: Small: Evaluating Cybersecurity Precautions and Harms in Israeli Enterprises

尽管组织在网络安全方面投入了大量资金，但他们往往无法回答有关其投资有效性的基本问题，例如哪些防御措施可以降低遭遇事故的风险，以及降低多少。他们努力准确地量化成功攻击造成的损害的财务成本。该项目旨在通过重点关注以色列企业的案例，提高对公司一级的网络安全做法如何影响这些结果的理解。通过将网络安全经济学方面的知名学者与以色列国家网络局(INCD)汇聚在一起，该项目有助于推进以色列国及其组织的网络安全。此外，它还促进了对网络风险管理的科学理解，同时为未来在美国和其他地方进行的数据收集和分析提供了一个模型。该项目侧重于三个关键的研究目标。首先，一系列实证分析考察了企业的风险敞口和安全防范措施如何影响经历网络事件的可能性。该分析利用了以色列S中央统计局进行的详细的公司层面调查的数据，并辅之以直接从公共来源收集的企业网络卫生外部测量。第二个研究目标是量化经历事故造成的伤害。为此，该项目分析了以色列CERT热线收集的数据，该热线询问企业受害者勒索软件攻击造成的影响。此外，CBS还对涉及危害的调查问题进行了分析。第三个研究目标是开发和分析纵向网络风险指标。项目团队与INCD和CBS合作，分析从随后几年重新管理调查中获得的纵向数据。这一奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Even though organizations are investing heavily in cybersecurity, they often cannot answer basic questions about the effectiveness of their investments, such as which defenses reduce the risk of suffering an incident, and by how much. They struggle to accurately quantify the financial costs of the harms resulting from successful attacks. This project seeks to improve understanding of how firm-level cybersecurity practices affect these outcomes by focusing on the case of Israeli enterprises. By bringing together leading scholars in the economics of cybersecurity with the Israeli National Cyber Directorate (INCD), the project helps advance the cybersecurity of the state of Israel and its organizations. Moreover, it advances the scientific understanding of cyber risk management while serving as a model for future data collection and analysis undertaken in the U.S. and beyond. The project focuses on three key research objectives. First, a series of empirical analyses examine how exposure and security precautions of enterprises affect likelihood of experiencing a cyber incident. The analysis leverages data from detailed firm-level surveys carried out by Israelís Central Bureau of Statistics (CBS), complemented by external measurements of enterprise cyber hygiene gathered directly from public sources. The second research objective is to quantify the harms resulting from experiencing an incident. For this effort, the project analyzes data gathered by the Israeli CERT hotline that asks enterprise victims about the impacts resulting from ransomware attacks. Additionally, CBS survey questions involving harm are analyzed. The third research objective is to develop and analyze longitudinal cyber risk indicators. The project team collaborates with INCD and CBS to analyze longitudinal data obtained from readministering the survey in subsequent years.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.