Affiliation:
1. Amsterdam Business School, Faculty of Economics and Business University of Amsterdam (UvA) Amsterdam The Netherlands
2. School of Computer Science – Laboratory of Security and Forensic Research (SAFeR) University of Central Lancashire (UCLan) Preston UK
Abstract
AbstractThe challenge of decision‐making under uncertainty in information security has become increasingly important, given the unpredictable probabilities and effects of events in the ever‐changing cyber threat landscape. Cyber threat intelligence provides decision‐makers with the necessary information and context to understand and anticipate potential threats, reducing uncertainty, and improving the accuracy of risk analysis. The latter is a principal element of evidence‐based decision‐making, and it is essential to recognize that addressing uncertainty requires a new, threat‐intelligence (TI) driven methodology, and risk analysis approach. We propose a solution to this challenge by introducing a TI‐based security assessment methodology and a decision‐making strategy that considers both known unknowns and unknown unknowns. The proposed methodology aims to enhance the quality of decision‐making by utilizing causal graphs, which offer an alternative to conventional methodologies that rely on attack trees, resulting in a reduction of uncertainty. Furthermore, we consider tactics, techniques, and procedures that are possible, probable, and plausible, improving the predictability of adversary behavior. Our proposed solution provides practical guidance for information security leaders to make informed decisions in uncertain situations. This paper offers a new perspective on addressing the challenge of decision‐making under uncertainty in information security by introducing a methodology that can help decision‐makers navigate the intricacies of the dynamic and continuously evolving landscape of cyber threats.
Reference56 articles.
1. DekkerM.Medium.com.March 19 2022. Accessed 15 January 2023.https://martijn‐dekker.medium.com/managing‐information‐security‐is‐managing‐uncertainty‐1f8c17148e45
2. ISO.International Organization for Standardization. International Organization for Standardization. 2018. Accessed January 15 2023.https://www.iso.org/news/ref2263.html
3. ISO.International Organization for Standardization. 2022. Accessed 15 January 2023.iso.org/obp/ui/#iso:std:iso‐iec:27005:ed‐4:v1:en
4. ISO/IEC.International Organization for Standardization (ISO). October 4 2022. Accessed December 28 2022.https://www.iso.org/standard/80585.html
5. NIST.National Institute of Standards and Technology. April 16 2018. Accessed January 12 2023.https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
Cited by
7 articles.
订阅此论文施引文献
订阅此论文施引文献,注册后可以免费订阅5篇论文的施引文献,订阅后可以查看论文全部施引文献