Is there a Cyber-risk quantification model in financial terms. I have conducted a probabilistic quantification model for my organisation followed by a CVSS score calculation. Now wish to quantify my organisation's cyber-risk in financial terms.
Want to expand my work in the field of Cyber Economics. Please suggest suitable model(s)/materials(freely accessible). Thank you.
Sorry. What makes you think it's me? That is not my subject of research.
Excellent thought. Enterprise Risk mgmt has been traditionally focusing on financial risks and bringing cyber risks into this is a great idea. You would have used probability and impact of various risks to arrive at a risk index. There is also another concept before we do risk assessment called Asset valuation. All information assets are valued using a 3 or 5 point scale in terms of Confidentiality, Integrity and Accessibility (CIA)- in terms of extent of business impact in the event of a breach. For example, the Asset value of an Audited Balance Sheet can be very high though its cost may be very low. A big chandelier in the lobby may cost USD 100k but its value in terms of CIA is negligible. Use this concept of asset valuation and this will help you where to focus most. This value then can be converted into a financial value by using a multiple. Hope this helps. Stay safe.
There is an insutech called cybercat which does quantification of cyber risk. Check cybercat.co.in
- Badges
- Science topic
- Similar topics
- Philosophy
- Ethics