QuantTM: Business-Centric Threat Quantification for Risk Management and Cyber Resilience

TL;DR

QuantTM is a novel threat quantification approach that integrates business perspectives to assess financial impacts of threats, aiding decision-making in cybersecurity investments.

Contribution

It introduces a business-centric threat quantification method that incorporates operational and strategic views for economic risk assessment.

Findings

Demonstrated feasibility in a Swiss SME case study.

Showed improved interpretability for decision-makers.

Validated usability of the prototype tool.

Abstract

Threat modeling has emerged as a key process for understanding relevant threats within businesses. However, understanding the importance of threat events is rarely driven by the business incorporating the system. Furthermore, prioritization of threat events often occurs based on abstract and qualitative scoring. While such scores enable prioritization, they do not allow the results to be easily interpreted by decision-makers. This can hinder downstream activities, such as discussing security investments and a security control's economic applicability. This article introduces QuantTM, an approach that incorporates views from operational and strategic business representatives to collect threat information during the threat modeling process to measure potential financial loss incurred by a specific threat event. It empowers the analysis of threats' impacts and the applicability of security controls, thus supporting the threat analysis and prioritization from an economic perspective. QuantTM comprises an overarching process for data collection and aggregation and a method for business impact analysis. The performance and feasibility of the QuantTM approach are demonstrated in a real-world case study conducted in a Swiss SME to analyze the impacts of threats and economic benefits of security controls. Secondly, it is shown that employing business impact analysis is feasible and that the supporting prototype exhibits great usability.