A Systems Approach for Cybersecurity Risk Assessment

This paper presents a methodology for assessing the cybersecurity risk of an information system to support trade studies between competing architectures, risk mitigation, and risk-informed decision making. It draws on key concepts from the fields of risk analysis, reliability engineering and cybersecurity. Standard system reliability studies do not readily translate to cybersecurity since (1) the cyber-failures are not random but caused by an attacker, and (2) the behavior of the attacker is not predictable. In this paper, a new approach is presented to extend key concepts from risk and reliability engineering to include cyber failures. The methods developed in this paper can be readily applied to quantitatively assess system cyber risk and provide reliability metrics. These methods are therefore very practical for real world applications. Cyber vulnerabilities are divided into three classes: known vulnerabilities with known threats; known vulnerabilities with unknown threats; and unknown vulnerabilities, which can occur due to zero-day vulnerabilities, or from a failure to follow procedures or successfully scan for identifiable vulnerabilities. The classic definition of risk is extended to encompass cyber exploits. The failure behavior of systems due to cyber exploits is defined and modeled using a combination of Markov Chains, Weibull analysis and Fault Trees. Knowledge about a system’s network topology is used to assess exploitation paths. Data used for quantifying the likelihood of an exploit is based on system performance metrics, such as cyber-hygiene; history of vulnerabilities, threats and exploits; and finally, industry statistics.