#  QBER: Quantifying Cyber Risks for
Strategic Decisions

Muriel Figueredo Franco, Aiatur Rahaman Mullick, Santosh Jha
Zeron – The Single Point of Truth for Cybersecurity
Mumbai, India
Email: [muriel, aiatur<EMAIL_ADDRESS>

###### Abstract

Quantifying cyber risks is essential for organizations to grasp their
vulnerability to threats and make informed decisions. However, current
approaches still need to work on blending economic viewpoints to provide
insightful analysis. To bridge this gap, we introduce QBER approach to offer
decision-makers measurable risk metrics. The QBER evaluates losses from
cyberattacks, performs detailed risk analyses based on existing cybersecurity
measures, and provides thorough cost assessments. Our contributions involve
outlining cyberattack probabilities and risks, identifying Technical,
Economic, and Legal (TEL) impacts, creating a model to gauge impacts,
suggesting risk mitigation strategies, and examining trends and challenges in
implementing widespread Cyber Risk Quantification (CRQ). The QBER approach
serves as a guided approach for organizations to assess risks and
strategically invest in cybersecurity.

###### Index Terms:

Cyber Risk, Risk Quantification, Cybersecurity Economics, Risk Management

##  I Introduction

The quantification of cyber risks is critical for companies and governments
that want to understand better their exposure to cyber threats [1]. This
exposure can be technical, where business configurations and assets can
increase the likelihood of cyberattacks, but also economical since
cyberattacks can cause direct and indirect impacts on business operations that
may cause financial losses [2, 3]. Therefore, practical approaches for Cyber
Risk Quantification (CRQ) must be considered during different security
decision-making processes within companies since it enables businesses to
strengthen their overall cybersecurity posture. Examples of scenarios that can
benefit from practical CRQ approaches include threat prioritization based on
technical and economic risks, measurement of potential losses due to
cyberattacks, and strategies to efficiently allocate business resources (i.e.,
money and time) [4].

However, CRQ is challenging since quantifying any potential risk a business
might face due to cyber threats involves many steps and requires the
correlation of different information (from business to technical level) [5].
In a recent report [6], for example, it was predicted that half of the
security leaders would not have success in using CRQ for decision making,
against only 36%, which will effectively be able to reduce risks and
operational costs by applying CRQ models. These statistics highlight real-
world challenges for companies to apply quantitative methods for efficient
risk assessment. Even though there are efforts to process vast amounts of data
to support decision-making, it is vital to provide CRQ approaches that add
value to a business and provide information that decision-makers need and
understand.

For an effective CRQ, different factors must be considered (e.g., the
likelihood of successful cyberattacks happening and their associated threats),
potential impacts of cyberattacks mapped, and cost analysis due to
cyberattacks and remediation have to be performed [7]. However, such
quantification is challenging since it requires knowledge from a Technical,
Economic, and Legal (TEL) perspective regarding a company and the entire
cybersecurity landscape. Therefore, approaches for CRQ must handle such
challenges and find effective ways to circumvent current limitations companies
face, including (i) information asymmetry among companies, (ii)
miscommunications between board levels, and (iii) lack of quantitative mapping
between threats and their actual TEL impacts.

There are efforts in academia and industry to bridge this gap. In recent
years, different works aimed to predict the risks of a cyber incident
happening [8, 9] and estimate its potential losses [3, 10]. Also, cyber
insurance companies have applied CRQ to assess the insurability of cyber risks
[11, 12] and for premium calculation [13]. In the industry, CRQ approaches and
tools have been used to measure the effectiveness of security controls and
quantify the overall security posture. Examples of well-known CRQ approaches
include quantile-based models such as the cyber value-at-risk initially
proposed by the World Economic Forum [14] and improved by the FAIR institute
[15], thus becoming a de facto model for information risk management. However,
there is still a need for holistic and practical approaches that consider,
from a TEL perspective, the business characteristics, its cyber risks, and
potential impacts to provide insightful analysis and recommendations based on
real-world data and statistical simulations.

To bridge this gap, in this article, we propose the Quantified Business
Exposure to Risk (QBER) approach, a novel approach for CRQ that considers both
technical and economic perspectives of cybersecurity to provide quantitative
metrics to inform decision-makers on the actual financial risks that their
organizations are exposed to. This includes scores on potential financial loss
in case of cyberattacks and an in-depth risk analysis based on the current
cybersecurity controls implemented within a company. Such risks are described
per business units and segments that compose the organization, including their
strategic relevance, from the TEL perspective, for the business operation.
Also, QBER provides a complete cost analysis for companies based on industry
reports, standards, international and national regulations, and well-known
guidelines for cybersecurity. Thus, using our proposed CRQ approach, decision-
makers can conduct relevant steps of financial risk assessment and strategic
planning toward better cybersecurity investments and decisions.

The main contributions of this article can be summarized as follows.

  * •

The mapping of likelihood and risks of cyberattacks based on data collected
using open-source intelligence, industry reports, and feedback from security
experts;

  * •

The definition of potential TEL impacts based on companies’ characteristics
and business profiles;

  * •

A mathematical model to quantify the financial impacts and potential losses in
a business in case of cyberattacks;

  * •

A set of recommendations to reduce the risks while ensuring compliance and
cost-benefit investments;

  * •

An analysis and discussion on trends and challenges for the wide deployment of
CRQ as an enabler for real-world companies in different sectors.

The rest of this article is organized as follows. Section II provides a review
of the CRQ literature. Section III details the QBER and describes its steps.
Section IV discusses the challenges and opportunities for CRQ identified in
this work, followed by Section V, the conclusions and future work.

##  II Related Work

Cyber Risk Quantification (CRQ) is a specialized risk assessment step,
focusing on providing data-driven and explainable indicators for the decision-
making process. It provides measurable metrics and results that help decision-
makers understand dimensions not available in traditional risk assessment
methods. This includes understanding exposure to risks, threats, and financial
losses. Therefore, CRQ differs from traditional risk assessment regarding
goals, inputs, and communication, such as focusing on quantitative results,
incorporating data and analytics in the entire process, and enabling better
communication with stakeholders to make informed decisions.

Academia has focused on analyzing cyber risks from different perspectives [7,
16], including the technical, economic, and legal impacts. Also, novel
approaches have been developed to support measuring and mitigating impacts
based on such perspectives. Examples include approaches for business-centric
threat quantification using Business Impact Analysis (BIA) [8], prioritization
based on economic aspects[17, 18, 19], cyber insurance analysis based on CVaR
[20], and analysis of economic metrics for cost-efficient security decisions
[21]. Besides that, there are efforts to verify the actual benefits of
technical and statistical indicators to make systems safer [5]. Overall,
state-of-the-art shows potential to map and understand TEL impacts
effectively, but it can be measured when security indicators (e.g., threat and
exposure) are also considered.

Different industry sectors rely on well-established cyber risk models for risk
assessment and management. Some widely adopted models can be considered as de
facto standards, such as FAIR, ISO 27005, and NIST SP 800-30. However, the
different models applied have concerns, especially regarding their usage
complexity and the number of parameters required for their usage. Table I
compares selected models against the QBER.

Table I: Comparison of QBER against Industry Models

Model | Type | Ease of Use |  Number of Parameters | Popularity
---|---|---|---|---
FAIR | Quantitative | Complex | High | High
CyberInsight | Quantitative | Moderate | Moderate | Moderate
NIST SP 800-30 | Qualitative | Easy | Low | High
ISO 27005 | Qualitative | Complex | Moderate | High
OCTAVE | Qualitative | Moderate | Low | Moderate
QBER | Quantitative | Easy | Low | -

The Factor Analysis of Information Risk (FAIR) [15] allows for quantifying
cyber risk in financial terms. It uses several factors (e.g., loss events,
exploitability level, and controls implemented) to estimate potential
financial losses in case of cyberattacks. Although FAIR is a data-driven model
that aims to provide an easy-to-use approach for business leaders, it still
requires technical training and considerable effort (money and time) to
implement it properly. Also, the business must clearly understand its
underlying infrastructure and risk scenarios, which can be challenging for
most businesses.

As another relevant model, CyberInsight [22] is based on MITRE ATT&CK and
VERIS framework, which focuses on quantifying an organization’s cyber risk
posture by considering potential threat actors, vulnerabilities, impacts, and
controls implemented. CyberInsight can be helpful in resource allocation
decisions and comparison with specific industry sector benchmarks. However,
there are still challenges since it requires specific datasets and has limited
customization options.

Differently, NIST SP 800-30 [23] stands as a well-established framework for
qualitative assessment of cybersecurity risks. It allows organizations to
identify vulnerabilities and impacts on assets and implement efficient
security controls. The framework is a good point of entrance for cybersecurity
since it is straightforward. However, it needs to consider the financial cost
perspective explicitly, thus not being the best choice for planning
cybersecurity, which requires, for example, understanding the cost-benefit
analysis of investments.

Similarly to well-known approaches, ISO 27005 is an internationally recognized
framework for identifying, analyzing, and evaluating security risks. It is
built on the principles of the ISO 27000 series to provide a systematic
approach to risk management. It requires a significant investment of time and
money to fully understand and implement it effectively. This poses challenges
for organizations without technical expertise and a limited budget. Also,
there needs to be clear guidance on handling complex and sensitive data, thus
requiring organizations to use additional models and standards together with
ISO 27005. Although it allows customization for the specific needs of
organizations, such customization is challenging and requires high expertise
in risk management methodologies.

As another example, the Operationally Critical Threat, Asset, and
Vulnerability Evaluation (OCTAVE) [24] provides a structured approach for
identifying critical assets, mapping threats, and evaluating potential
impacts. It relies on qualitative categories (e.g., low, medium, high) to
assess the risk severity. OCTAVE is systematic, adaptable, and does not
require too many resources to use, thus making it suitable for organizations
that prioritize high-level risks. However, it does not consider explicitly the
financial dimensions of impacts and relies on very subjective risk
categorization.

Therefore, current quantitative CRQ models, although valuable, have
limitations. Established models like FAIR require adequate data, complex
calculations, and intensive training. Also, the current CRQ models need to
take a lot of other inputs as parameters, including all types of risks,
whether internal and external risks of an organization, compliance, regulatory
risks, or business risks. QBER approach automatically takes - based on a few
inputs from users - technical, business, legal, and economic parameters in a
straightforward way, which helps to assess cyber risk in more detail and
intuitively.

##  III The QBER Approach

The proposed QBER addresses the cyber risk quantification problem by providing
a novel approach that explores Open-Source Intelligence (OSINT), cybersecurity
economics models, and automated risk analysis techniques to provide insightful
information for decision-makers to understand their businesses’ risks and
associated costs. The approach receives companies’ information as input,
applies data mapping and economic models, infers data based on statistical
analysis and reports, and provides a set of measurable metrics and
recommendations for strategic decisions based on quantifying technical and
economic risks. Different standards and frameworks are integrated within the
proposed approach, such as MITRE ATT&CK for threats identification [25] and
the Secure Controls Framework for (SCF) [26] for initial mapping of efficient
controls against specific threats and risks.

The overview of the QBER is shown in Figure 1, including its different
modules, components, and their relationships. The Business Analysis module
receives inputs from the users in order to build a business profile in terms
of different business characteristics (e.g., country, regulations, sector, and
technical demands) and also understand how the businesses’ systems and
information are structured, such as which segments of information and assets
are relevant for the business operation from a technical and economic
perspective. Next, the Risk Analysis module identifies the risks and controls
implemented, including monitoring attack surface based on assets, segments,
business units, and associated technical and economic risks.

Figure 1: The QBER Approach

Finally, the Cost Analysis provides strategic analysis based on economic
models. In this module, the potential financial loss is quantified by applying
novel and state-of-the-art approaches, the costs to implement controls are
measured, and recommendations for cost-efficient cybersecurity strategies are
provided. All the modules interact with the Data Layer to obtain data and
information for the different analyses. This layer includes (i) statistical
data extracted from industry reports, standardization documents, and
regulations, (ii) insightful information regarding potential risks for
specific scenarios, and (iii) database with controls and guidelines for cost-
efficient strategic decisions to reduce risks.

The output of the QBER is a set of quantitative metrics that helps decision-
makers to understand technical and economic risks as well as plan and
prioritize their cybersecurity strategy. This includes the level of risks for
each business unit, segment, and asset. Potential economic losses are also
mapped, and risk prioritization can be performed to reduce financial impacts
while ensuring compliance with different guidelines and regulations. Each of
the modules and their relevant steps are described in detail in the rest of
this section. The approach and its metrics have been applied as part of
commercial products for the Banking, Financial Services, and Insurance (BFSI)
sectors111https://zeron.one/.

###  III-A Business Analysis

The business analysis is conducted automatically and manually by collecting
information regarding the business. Initially, the business details, which
most companies know, are required as input, such as the size of the business
revenue, number of employees, country of operation, sector, and different
business units that compose the company. Next, the specific segments worthy of
each business unit are defined. For example, a database of customers and a
payment system can be more critical for a specific business unit than others,
while web servers are the most important for other business units that offer
specific services.

Note that we consider the following definitions. Business unit is a division
within a company responsible for specific services with its management,
resources, and security. Segments are specific information or services within
business units that have different values for the business unit operation.
Together, business units and segments have risks that impact with different
magnitude the entire company of which they are part. Therefore, it is
necessary to consider such a fine-grained analysis when collecting and
understanding the business profile.

Table II: Overview of Information Collected to Build the Business Profile

Metric |  Description |  Example
---|---|---
Business Size |  Business revenue, employees, and business units |  Medium-sized business with $ 10 M as yearly revenue and 4 business units
Sector |  Industry sector where the business units operate |  Banking, financial and insurance
Country |  Country sector where the business units operate or offer services |  India, United States
Segments and Services |  Segments of information and services that have economic value for the business |  Customer Data, Payment System, Sales platform
Economic Details |  Profits and revenue per business units and segments |  60% of revenue from the sales platform
Implemented Controls |  Controls already Implemented and its current maturity |  Access Control, WAF, Endpoint Protection

Table II highlights the general information collected during the business
analysis. This also enables the companies to select specific compliance
standards applicable to business units and define which controls are already
in place to protect each business unit and specific segments. Understanding
the importance and how worthy (percentage of revenue) a business unit and
segment for the company is challenging but a key for accurately quantifying
TEL impacts. A guided approach is provided to the companies to collect all
data needed to infer the importance and relevance of such critical economic
details. Figure 2 shows the user’s flow of information and examples of paths
and information provided in whether publicly listed companies are being
considered. All these steps are performed using intuitive and guided
interfaces suitable for decision-makers.

Figure 2: User Flow of QBER’s Information Collection for Business Analysis
Implemented in a Commercial Solution¹

As risk factors and TEL impacts may differ according to the businesses’
characteristics, providing an in-depth analysis and accurate information is
essential. If information is missing, the QBER can use information obtained
from OSINT, industry reports, or even penetration tests and security analysis
results. Also, market averages, stock exchange analysis, and surveys with
similar companies can be used as input to understand the actual market trends.
Thus, we provide a database containing the mapping of business profiles with
threats, risks, and TEL impacts. This is used as input for the risk analysis
module.

###  III-B Risk Analysis

After collecting and processing the relevant information provided by the
company, the QBER starts the risk analysis process. This starts by
automatically analyzing all business units and assets to understand the attack
surface (e.g., monitoring assets, segments, and business units as seen by
potential attackers). This is conducted using proprietary solutions that
provide a technical analysis highlighting the most vulnerable points, such as
assets with a higher likelihood of an attack due to many Common
Vulnerabilities and Exposures (CVEs).

Although such a step is relevant for a precise CRQ, it is not easily
interpreted by the company’s board. Therefore, after having all the technical
details, it is necessary to understand and quantify the potential risks from a
TEL perspective. A rich database maps threats, controls, and associated costs.
Such a database is defined following de facto standards (e.g., NIST [27], SCF
[26], and ISO 27000 series [28]), security experts’ opinions, and data
collected using OSINT techniques from real-world and also industry reports
[3]. By using such information combined with the company details, the QBER can
conduct a detailed analysis to quantify not only risks and potential impacts
but also the potential financial losses in different scenarios (e.g., based on
information mapping, Monte Carlo simulations, and Cyber-Value-at-Risk models).

Table III summarizes the terminology used for the calculations. All symbols
are appropriately represented, including their definitions and descriptions
for each. The different metrics computed as part of the risk analysis module
of the QBER are introduced below.

Table III: Terminology of Symbols and Metrics Used on Equations

Symbol |  Metric |  Description
---|---|---
$w$ | Weight |  Value from 0 to 10 that describes Low, Medium, or High weight for a given metric
$Seg$ | Segment |  Segment of information or service that has value for a business
$Impacts$ |  Operational or Financial impacts |  Impacts measured from a technical and economic perspective
$T$ | Threat |  Threat under analysis, such as Phishing, Malware, and DDoS
$D$ | Domain |  Represent the different ways and dimensions that a cybersecurity strategy can consider
$Risk$ |  Technical or Economic risk |  The exposition to an cyberattack considering likelihood and potential success rate
$CIA$ |  Confidentiality, Integrity, Availability |  Analysis of security posture based on the CIA triad
$\alpha$ | Coefficient |  Value used to normalize the results of equations

The QBER initially considers two main impacts: Operational and Financial. The
operational reflects the capacity of a cyberattack to cause service disruption
or infrastructure damages, while the financial impact maps the magnitude of
potential financial loss due to a cyberattack. Therefore, the impacts of a
potential threat ($Impact_{w}$) are given as an operational and financial
impact factor. For example, for a given business unit that handles payments,
in the case of data leakage due to a cyberattack, the operational impact can
be Low or Medium if the data is not encrypted but only leaked. In contrast,
the financial impact will be High due to regulatory and compliance costs.

The operational impact might also be High if Ransomware disrupts the entire
payment service. The final impact will be generated based on potential
operational and financial impacts. Equation 1 shows the impact calculation per
threat. The values for each threat must be mapped according to the known
potential impacts based on the analysis of the business profile,
characteristics, and market trends.

$\displaystyle Impacts_{w}=Impact_{Operational}*Impact_{Financial}$ (1)

Next, the Economic Risk Score (RS) is determined based on cybersecurity
economic models available in the literature and technical metrics collected
from the business. For that, the RCVaR model [3] is used since it provides a
view of the different characteristics of a business and factors that can
increase or decrease the risk of economic impacts in case of cyberattacks. To
provide such analysis, RCVaR uses statistical analysis of different industry
reports and provides. RCVaR is then integrated into the QBER to quantify the
economic impacts and also determine the magnitude of potential impacts (low,
medium, or high).

Equation 2 defines the economic risk score. This is achieved by computing the
average of RCVaR factors times the current cybersecurity posture implemented
regarding Confidentiality, Integrity, and Availability (CIA). Note that the
CIA is obtained by analyzing the current controls implemented by the company
and how they help to ensure the different elements of the cybersecurity triad.
The $RS_{Economic}$ metric provides then an analysis of the magnitude of
exposition to economic impacts due to cyberattacks. The potential economic
impact is computed later using additional metrics (cf. Section III-C)

$\displaystyle RS_{Economic}=avg(RCVaR_{Factors})*avg(CIA)$ (2)

Based on the risks identified and the business profile, decision-makers can
prioritize where to invest their time and money to reduce them. For that, the
QBER highlights, using the concept of domain prioritization, which kind of
protection can be prioritized against specific cyberattacks.

Domain prioritization ($D_{p}riority$) involves determining which strategy
might be applied first to reduce the potential impacts of specific threats.
For example, the domains People and Awareness and Endpoint Protection must
have prioritization in case of planning against Phishing attacks. At the same
time, Endpoint and Database protection can be considered for Ransomware cases.

Therefore, it is possible to determine in which way and dimension that company
must focus resources when defining a cybersecurity strategy. Equation defines
how the prioritization is calculated, where $T_{w}$ represents how relevant a
threat is for a domain and $Impact_{w}$ determines the magnitude of TEL
impacts in case of $T$ happen. QBER considers fifteen cybersecurity domains
extracted from technical standards.

$\displaystyle D_{priority}=T_{w}*(\alpha+Impact_{Weight})$ (3)

###  III-C Cost Analysis

By knowing the risks the company might face and the magnitude of potential
impacts, the QBER provides a quantification of the financial losses that the
company can expect per asset and segment of information. This is calculated
considering the monetary value of a given segment for the business and impacts
previously collected from industry reports and mapped in our database (e.g.,
the potential operational and economic impacts of a DDoS in an e-commerce).
These impacts are determined as high, medium, and low and later converted to a
range of numbers for the segment impact quantification ($Seg_{Impact}$).

Equation 4 shows how the financial impact is calculated per segment. It is
considered the revenue of the business that is dependent on a specific segment
or asset, and then this monetary value is adjusted based on the impact of a
specific threat. Thus, the $Seg_{Impact}$ should be computed per segment and
threat. This can be used as an independent value to understand the economic
risks of specific threats (e.g., Phishing or Ransomware) to a given segment.
However, it also can be used as a weighted quantification to determine the
overall economic impact (considering all threats).

$\displaystyle Seg_{Impact}=Seg_{Revenue}*Impact_{w}$ (4)

After the definition of the potential impact (worst scenario), it is computed
the actual segment risk ($Seg_{Risk}$) by considering the impact’s magnitude
and also the risk of an attack being successful. Therefore, $Seg_{Risk}$ is
the actual risk based on the current controls implemented and the likelihood
of an attack happening and being successful. Equation 5 computes its risk and
provides, as output, the monetary value quantified as possible loss in case of
a cyberattack in such a segment. If new controls are implemented, the
$Seg_{Risk}$ can be computed again to verify the updated economic risk score.

$\displaystyle Seg_{Risk}=Seg_{Impact}*(Impact_{w}*Risk_{w})$ (5)

The effectiveness of controls against specific threats has also to be
considered. This effectiveness is defined based on its capacity to reduce the
potential risk of successful attacks and TEL impacts. The control costs can
also be compared against others since controls require high costs due to
associated Capital Expenditures (CAPEX) and Operational Expenditures (OPEX).
On the other hand, solutions with reduced CAPEX and OPEX might slightly reduce
the risks (even in a lower magnitude) but with a better cost-benefit.

Note that the maturity of the controls implemented is also crucial since the
the effectiveness of a control is driven by how it is implemented [29], which
includes security policies and controls’ maturity. Therefore, A company with
initial or repeatable maturity might have an adjustment on the actual control
efficacy, while an optimized maturity ensures the best case of control
efficacy. This is computed as part of our model to find a company’s actual
protection (and risks) based on the implemented controls. The QBER assigns a
quantitative score to each control ($Maturity_{Level}$) according to its
maturity and uses it to reduce or increase the original efficacy of a control
based on its maturity level:

  * •

Not Implemented: 1.25

  * •

Initial: 0.65

  * •

Repeatable: 0.55

  * •

Defined: 0.45

  * •

Managed: 0.31

  * •

Optimized: 0.25

These values are used together with a control importance score to determine
the actual efficacy of the control. For example, suppose the maturity of
control is initial, and the control importance score is high. In that case, it
means that the efficacy of the control would be reduced from high to medium.
Therefore, this means that controls with high importance and efficacy might
have the efficacy reduced in case the maturity of the controls is not
adequate. The mapping of maturity and its importance score is done as follows.
The actual control efficacy ($ControlEfficacy_{T}$) for a given threat is
calculated using the promised efficacy and the current maturity level
implemented, as shown in Equation 6. As input for the $Efficacy_{T}$. QBER
provides a map of control’s importance based on different risk scenarios.

$ControlEfficacy_{T}=Efficacy_{T}*(1.25-Maturity_{Level})$ (6)

A set of recommendations can be provided based on compliance needs. However,
companies tend to have a limited cybersecurity budget and must decide on the
most cost-effective protections while encompassing compliance. For that, a
modified version of the well-known Return on Security Investment (ROSI) model
[19] is provided. The modified ROSI named as Z-ROSI is shown in Equation 7. As
can be seen, it differs from the original ROSI by integrating the cost rate
and technical exposure into the calculation. This creates a specialized model
that can be adapted according to the company’s demands, even for companies
that do not have a clear view of their risks, actual technical and financial
exposure, and control costs.

$Z\text{-}ROSI=\frac{((ALE*Control_{Efficacy})-(Control_{Cost}*Cost_{Rate})}{(Control_{Cost}*Cost_{Rate})}$

(7)

In Equation 8, the exposure is computed as a function of the CIA obtained by
previous analysis. This shows the percentage of exposure of the company to CIA
faults. Next, in Equation 9, the Annual Loss Expectancy (ALE) is defined based
on the calculated exposure and the current potential financial loss of a given
segment or business unit.

$\displaystyle Exposure=1-avg(CIA)$ (8)

$\displaystyle ALE=Exposure*Seg_{Impact}$ (9)

Thus, applying the Z-ROSI makes it possible to understand if a specific
control to be implemented is cost-effective. For that, it considers the cost
of the control, the current potential loss of the asset that the control will
protect, and the risk exposure. This ensures a more realistic and suitable
approach for ROSI calculation since it uses information collected from the
company using the QBER and infers complex information that usually is not
entirely known by companies, such as risks and potential costs.

In summary, the QBER provides a well-defined approach and model for
quantifying risks from an economic and technical perspective. The model
comprises a set of metrics that helps decision-makers understand their
business’ cybersecurity posture and better plan their cybersecurity
strategies. The metrics are provided for a complete analysis and
quantification of how much the business is exposed to financial impacts due to
cyberattacks. They also highlight potential weaknesses in the business’
cybersecurity strategy that must be prioritized.

Thus, using the QBER, it is possible to identify loss probability trends and
risk scenarios to specific threats, prioritize investment based on identified
risks, and understand the efficacy of current controls implemented within
different business units. Also, the cost of investing in cybersecurity is
covered by applying economic metrics that help to find cost-effective controls
to reduce potential TEL impacts and overall risk exposure.

##  IV Demands, Trends, and Challenges for CRQ

CRQ is gaining attention mainly due to the demands of companies from different
sectors that urge them to make cybersecurity decisions effectively.
Influential in this context means protecting their main assets and
encompassing regulations without overspending their budget. For that, it is
critical to have more data and metrics and insightful information that can be
used by multidisciplinary stakeholders (e.g., from business, cybersecurity,
statistics, and economics fields) with different levels of expertise.
Therefore, this is a demand from industry and society to take control of their
posture to survive in the digital world.

In a recent survey conducted by Gartner [4] with board managers and the
C-suite, it was observed that CRQ has been used chiefly for cyber insurance
and compliance reporting, followed by prioritization of security investments.
CRQ models increase the confidence of the board and make it easier to convince
risk owners to remediate risks. Also, the business exposure can be better
understood during risk analysis tasks. We can see an increasing investment in
CRQ as a trend. However, stakeholders still need help understanding the CRQ
analysis due to the lack of guidance and the subjective nature of current CRQ
methodologies.

Cyber insurance companies are also relying on CRQ models [20, 30] to provide
better premium calculations, coverage, and risk appetite analysis [31].
According to a recent report from Munich RE [32], one of the biggest world
cyber insurance companies, the finance sector is responsible for more than
half of all cyber insurance claims, with ransomware, business communication
compromise, and data breaches being the major loss drivers. It is also
possible to see a trend for AI-based protections being used, with future AI
regulations having the potential to impact the compliance needs of companies
in terms of cybersecurity.

From the cyber risk perspective, AI-based solutions [9, 33] have arisen as a
potential ally to address the asymmetry of information issues and also to
identify patterns in attack behaviors and their impacts. For the
prioritization of threats, the Exploit Prediction Scoring System (EPSS) [34]
has gained attention from the industry due to its capacity to estimate the
probability of a vulnerability being exploited in the next 30 days. The EPSS
relies on real-world exploit and threat information from many OSINT and
proprietary sources.

The economic impacts of cyberattacks still lack a de facto model. The
companies tend to rely on general models like the Business Impact Analysis
(BIA) [8] and FAIR model [15] to understand potential impacts. However, these
models still depend on subjective elements that may vary according to their
applications and configurations. Companies also adopt economic models.
Examples are the well-known ROSI [19] for calculation of cost-benefit of
cybersecurity investments and other classical models like CVaR for estimation
of financial losses [20] and variations of Gordon-Loeb [17, 35] for optimal
cybersecurity investment. From the academia, there are also prominent
applications using the CVaR and Gordon-Loeb as a basis, such as the RCVaR
model [3] that provides insights on financial loss based on industry reports
and SECAdvisor [18] that applies the Gordon-Loeb model as part of the
cybersecurity planning.

Although certain models have gained traction in the cybersecurity community,
there are still drawbacks that have to be highlighted and further addressed.
Most models are resource-intensive since they need substantial industry data,
time, and technical expertise for comprehensive risk analysis. Also, the
current models rely on probability estimation, which may foster a false sense
of certainty, thus potentially undermining risk assessments. These limitations
can be seen in widely used models, such as the FAIR model and Gordon-Loeb.

The need for vulnerability prioritization and strategic reasoning is also a
limitation. This has been a concern for both academia and industry, which are
focusing on providing ways to understand what has to be solved now and what
can wait. Therefore, one of the trends mapped is methodologies and models for
prioritizing vulnerabilities, resources, and monetary investment. Examples
include the EPSS or even the usage of EPSS and CVSS together, as recommended
by FIRST [36]. However, there are still challenges, especially due to the
dynamic nature of data that may change security strategies substantially every
day. Also, such methodologies tend to be very technical-oriented, thus making
it hard to be used to draw the attention of the board and C-level within
companies.

The efficacy of controls is related not only to whether the control is
implemented but also to how the control is implemented. Therefore, it needs to
understand the business processes and the maturity of the implemented
processes and controls. An in-depth analysis is challenging because many
business and technical elements must be checked when understanding the
maturity. However, there are established solutions - as applied by the QBER
approach - that can help to understand the maturity to be used as part of more
complex models. Examples of such solutions include the IT General Controls
Capability Maturity Model (CMM) [37] and the SCF [26]. Automated and AI-based
approaches can support data collection to analyze business characteristics and
attack surfaces better. However, AI may still face challenges regarding
adversarial attacks and regulations.

Furthermore, the industry is moving towards a more explainable cybersecurity
cost analysis, while academia has also focused on providing more accurate and
intuitive models. More intuitive and efficient CRQ becomes an urgent need for
companies since cybersecurity is becoming too complex to operate and
understand, with vast amounts of data and technical metrics being provided
daily for a - still challenging - decision-making process. Approaches like the
proposed QBER are utmost to empower companies with well-defined steps -
anchored by real-world data and business demands - for quantification of risks
and associated costs.

##  V Conclusions and Final Remarks

CRQ is critical for companies to survive in a digital world. Cyberattacks
continue to increase risks and TEL impacts while efficient cybersecurity
strategies are in demand. Determining an efficient strategy requires
understanding information in a qualitative and quantitative way, thus
empowering decision-makers with more data and measurable metrics to guide the
decision process. For that, CRQ approaches can benefit technical and non-
technical people in determining what to prioritize, where to focus, and how to
protect.

The QBER approach is proposed to address such scenarios where measurable
metrics must be provided clearly in a way to make informed decisions. For
that, QBER proposes a model to quantify actual financial risks the
organizations are exposed to while also providing insights about possible
legal (e.g., compliance to specific regulations) and technical risks (e.g.,
level of controls implemented and potential threats). The likelihood and risks
of cyberattacks are provided based on the mapping of real-world data and
security experts’ analysis, followed by the definition of potential impacts
based on companies’ characteristics and business profiles. A model is proposed
to compute the actual risks and potential financial impacts in case of
cyberattacks, followed by recommendations to reduce the risks cost-
effectively. QBER relies on extensions of well-established models and provides
novel equations to quantify such risks and impacts.

The analysis of the threat landscape and current efforts for CRQ shows that it
is gaining prominence, particularly for cyber insurance, compliance reporting,
and security investment prioritization. It enhances board confidence and
facilitates risk mitigation efforts. Despite increasing investment,
stakeholders need help understanding CRQ analysis due to its subjective nature
and lack of guidance. It shows the need for explainable and easy to use
approaches like QBER to guide the CRQ process and provide a complete approach
containing a flexible model (e.g., addressing different scenarios,
regulations, and controls) and extensible datasets for accuracy calibration.

Future work includes validating the proposed approach in selected real-world
companies and security experts. Also, a quantitative analysis is mapped to
compare our mathematical models’ behavior against others in literature (e.g.,
Gordon-Loeb, Monte Carlo simulations, FAIR, and ROSI). Further, an in-depth
analysis of the accuracy of the estimations and recommendations provided by
the QBER approach will be provided. Along with this, more data points from
different Security Solution would be supported which would help in enhancing
the analysis of risks. Such evaluations can validate our approach as a key for
cybersecurity posture management and strategic planning.

## References

  * [1] Z. Amin, “A Practical Road Map for Assessing Cyber Risk,” _Journal of Risk Research_ , Vol. 22, No. 1, pp. 32–43, 2019.
  * [2] T. Moore, “Introducing the Economics of Cybersecurity: Principles and Policy Options,” _Workshop on Deterring CyberAttacks_ , Washington, DC, USA, April 2010, pp. 1–21.
  * [3] M. F. Franco, F. Künzler, J. von der Assen, C. Feng, and B. Stiller, “RCVaR: an Economic Approach to Estimate Cyberattacks Costs using Data from Industry Reports,” _Computers & Security_, p. 103737, 2024.
  * [4] Gartner, “Cyber Risk Quantification (CRQ): Adoption And Impacts,” 2023, Available at https://www.gartner.com/peer-community/oneminuteinsights/cyber-risk-quantification-crq-adoption-impacts-sh3.
  * [5] D. W. Woods and R. Böhme, “SoK: Quantifying Cyber Risk,” _IEEE Symposium on Security and Privacy (SP)_. San Francisco, USA, IEEE, 2021, pp. 211–228.
  * [6] Gartner, “Gartner Unveils Top Eight Cybersecurity Predictions for 2023-2024 ,” 2024, Available at https://www.gartner.com/en/newsroom/press-releases/2023-03-28-gartner-unveils-top-8-cybersecurity-predictions-for-2023-2024.
  * [7] M. F. Franco, L. Z. Granville, and B. Stiller, “CyberTEA: a Technical and Economic Approach for Cybersecurity Planning and Investment,” _36th IEEE/IFIP Network Operations and Management Symposium (NOMS 2023)_ , Miami, USA, 2023, pp. 1–6.
  * [8] J. von der Assen, M. F. Franco, M. Dong, and B. Stiller, “Quanttm: Business-centric threat quantification for risk management and cyber resilience,” _arXiv preprint arXiv:2402.14140_ , 2024.
  * [9] M. F. Franco, E. Sula, A. Huertas, E. J. Scheid, , L. Z. Granville, and B. Stiller, “SecRiskAI: a Machine Learning-Based Approach for Cybersecurity Risk Prediction in Businesses,” _24th IEEE International Conference on Business Informatics (CBI 2022)_. Amsterdan, Netherlands, IEEE, June 2022, pp. 1–10.
  * [10] A. Erola, I. Agrafiotis, J. R. Nurse, L. Axon, M. Goldsmith, and S. Creese, “A System to Calculate Cyber Value-at-Risk,” _Computers & Security_, Vol. 113, p. 102545, 2022.
  * [11] M. Malavasi, G. W. Peters, P. V. Shevchenko, S. Trück, J. Jang, and G. Sofronov, “Cyber risk frequency, severity and insurance viability,” _Insurance: Mathematics and Economics_ , Vol. 106, pp. 90–114, 2022.
  * [12] V. Matejka and J. A. H. Soto, “A Framework for the Definition and Analysis of Cyber Insurance Requirements,” Master Project, Communication Systems Group, Department of Informatics, Universität Zürich UZH, Zürich, Switzerland, September 2021.
  * [13] H. Jiang, N. Khanna, Q. Yang, and J. Zhou, “The cyber risk premium,” _Management Science_ , 2024.
  * [14] World Economic Forum (WEF), “Towards the Quantification of Cyber Threats,” 2015.
  * [15] FAIR Institute, “Is FAIR a Value-at-Risk Model?” January 2018, Available at https://www.fairinstitute.org/blog/is-fair-a-value-at-risk-model.
  * [16] M. F. Franco, “CyberTEA: a Technical and Economic Approach for Cybersecurity Planning and Investment,” February 2023, PhD Thesis, Communication Systems Group, Department of Informatics, Universität Zürich UZH, Zürich, Switzerland, Available at https://figueredofranco.com/static/files/PhD-M-Franco.pdf.
  * [17] L. A. Gordon, M. P. Loeb, L. Zhou, “Information Segmentation and Investing in Cybersecurity,” _Journal of Information Security_ , Vol. 12, pp. 115–136, January 2021.
  * [18] M. F. Franco, C. Omlin, O. Kamer, E. J. Scheid, and B. Stiller, “SECAdvisor: a Tool for Cybersecurity Planning using Economic Models,” 2023.
  * [19] W. Sonnenreich, J. Albanese, and B. Stout, “Return on Security Investment (ROSI)-a Practical Quantitative Model,” _Journal of Research and Practice in Information Technology_ , Vol. 38, No. 1, pp. 45–56, 2006.
  * [20] A. Orlando, “Cyber Risk Quantification: Investigating the Role of Cyber Value at Risk,” _Risks_ , Vol. 9, No. 10, p. 184, 2021.
  * [21] Z. A. Collier, B. Briglia, T. Finkelston, M. C. Manasco, D. L. Slutzky, and J. H. Lambert, “On metrics and prioritization of investments in hardware security,” _Systems Engineering_ , Vol. 26, No. 4, pp. 425–437, 2023.
  * [22] CyberSaint Security, “What is CyberInsight? ,” January 2023, Available at https://www.cybersaint.io/blog/how-to-choose-the-right-cyber-risk-quantification-company-for-your-needs.
  * [23] National Institute of Standards and Technology (NIST), “Security and Privacy Controls for Information Systems and Organizations,” 2020, nIST Special Publication 800-53. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf.
  * [24] C. Alberts, A. Dorofee, J. Stevens, and C. Woody, “Introduction to the OCTAVE Approach,” pp. 72–74, 2003, pittsburgh, PA, Carnegie Mellon University, Available at https://apps.dtic.mil/sti/pdfs/ADA634134.pdf.
  * [25] MITRE, “MITRE ATT&CK,” 2024, Available at https://attack.mitre.org/ .
  * [26] SCF, “Secure Controls Framework,” 2023, Available at https://securecontrolsframework.com/ .
  * [27] NIST, “The NIST Cybersecurity Framework (CSF) 2.0,” 2024, Available at https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf .
  * [28] B. Vignau, R. Khoury, S. Hallé, and A. Hamou-Lhadj, “ISO 27001 Risk Management and Compliance,” _Journal of Risk Management_ , Vol. 54, No. 1, pp. 1–24, 2021.
  * [29] D. W. Woods and S. Seymour, “Evidence-based cybersecurity policy? A meta-review of security control effectiveness,” _Journal of Cyber Policy_ , Vol. 0, No. 0, pp. 1–19, 2024.
  * [30] K. Palsson, S. Gudmundsson, and S. Shetty, “Analysis of the impact of cyber events for cyber insurance,” _The Geneva Papers on Risk and Insurance-Issues and Practice_ , Vol. 45, pp. 564–579, 2020.
  * [31] M. Malavasi, G. W. Peters, P. V. Shevchenko, S. Trück, J. Jang, and G. Sofronov, “Cyber risk frequency, severity and insurance viability,” _Insurance: Mathematics and Economics_ , Vol. 106, pp. 90–114, 2022.
  * [32] Munich RE, “Cyber Insurance: Risk and Trends 2024,” 2024, Available at https://www.munichre.com/en/insights/cyber/cyber-insurance-risks-and-trends-2024.html.
  * [33] I. H. Sarker, M. H. Furhad, and R. Nowrozy, “AI-driven cybersecurity: an overview, security intelligence modeling and research directions,” _SN Computer Science_ , Vol. 2, No. 3, p. 173, 2021.
  * [34] J. Jacobs, S. Romanosky, B. Edwards, I. Adjerid, and M. Roytman, “Exploit Prediction Scoring System (EPSS),” _Digital Threats: Research and Practice_ , Vol. 2, No. 3, pp. 1–17, 2021.
  * [35] H. R.K. Skeoch, “Expanding the Gordon-Loeb Model to Cyber-Insurance,” _Computers & Security_, p. 102533, 2021.
  * [36] FIRST, “EPSS User Guide,” 2024, Available at https://www.first.org/epss/user-guide.
  * [37] M. C. Paulk, B. Curtis, M. B. Chrissis, and C. V. Weber, “Capability Maturity Model, Version 1.1,” _IEEE Software_ , Vol. 10, No. 4, pp. 18–27, 1993.

All links provided above were last accessed on May 2024.

## Biography

|  Dr. Muriel F. Franco is a Senior Research Consultant at Zeron and
Postdoctoral Researcher at the Computer Networks Group of Federal University
of the Rio Grande do Sul (UFRGS). In his research career, he participated in
different multidisciplinary projects within teams of networking,
cybersecurity, and economic experts, with over 70 research papers and patents
co-authored. Muriel holds a PhD (Summa cum laude) from 2023 in Computer
Science from the University of Zurich UZH, Switzerland, MBA from 2022 in
Project Management from the University of São Paulo (USP), Brazil, MSc from
2017 in Computer Science from Federal University of Rio Grande do Sul (UFRGS),
Brazil, and received a BSc from 2014 in Computer Science from the Federal
University of Pelotas (UFPEL), Brazil. His research interests include
cybersecurity, network management, risk management, and communication systems.
---|---
|  Aiatur R. Mullick is an experienced cybersecurity professional at Zeron who
has the expertise of effectively guide enterprises in defining priorities for
their cyber risks. Mullick’s expertise rests in engaging with organisations to
establish comprehensive risk registers and implement tailored risk mitigation
plans. With considerable expertise in implementing controls for various
regulations and standards, Aiatur delivers a feasible, results-oriented
approach to enhancing enterprise cybersecurity posture.
---|---
|  Santosh Jha is a vivid cybersecurity researcher and Chief Technology
Officer at Zeron. He is a Certified Ethical Hacker and a Certified Information
Systems Auditor. During his tenure at Zeron, he led the implementation of the
Cyber Risk Posture Management Platform with his knowledge and experience in
cybersecurity, risk management, information and data security. He holds a
Bachelor of Technology degree in Electronics and Communication Engineering
from Maulana Abul Kalam Azad University of Technology (MAKAUT). He has a keen
interest in Economics involved in Cybersecurity, Shell Scripting, Networking
and Risk Management.
---|---