Why 2 times 2 ain't necessarily 4 - at least not in IT security risk assessment

TL;DR

This paper critically analyzes a new semi-quantitative IT security risk assessment method, exposing flaws and proposing an improved hybrid approach combining semi-quantitative assessment with threat and risk analysis.

Contribution

It identifies systematic flaws in the IEC 62443-3-2 draft's risk assessment approach and proposes a novel hybrid method integrating semi-quantitative and qualitative analysis.

Findings

Exposes flaws in the IEC 62443-3-2 draft approach

Proposes a hybrid risk assessment method

Enhances accuracy of IT security risk evaluation

Abstract

Recently, a novel approach towards semi-quantitative IT security risk assessment has been proposed in the draft IEC 62443-3-2. This approach is analyzed from several different angles, e.g. embedding into the overall standard series, semantic and methodological aspects. As a result, several systematic flaws in the approach are exposed. As a way forward, an alternative approach is proposed which blends together semi-quantitative risk assessment as well as threat and risk analysis.