Countermeasure Portfolio Management of Silent Cyber Risks for Suitable Return of Investment

Abstract

In recent years, with the continuing development of the Internet of Things (IoT), various devices are now connected a huge number of networks and are being used for diverse pur-poses. The IoT has the potential to link cyber risks to actual property damage, as cyberspace risks are connected to physical space. With this increase in unknown cyber risks, the demand for cyber insurance is increasing. One of the most serious emerging risks is the silent cyber risk, and it is only likely to increase in the future. However, at present, security countermeas-ures against silent cyber risks are insufficient. In this paper, we propose a countermeasure portfolio management of silent cyber risk for organizations with the objective of contributing to the development of risk management methods against new cyber risks. Specifically, we modeled silent cyber risk by focusing on state transitions to different risks. We newly defined two types of silent cyber risk, Alteration risk and Combination risk, and conducted a risk assessment that identified 23 risk factors. After analyzing them, we found that all were clas-sified as Risk Transference. We clarified that the most effective risk countermeasure for Al-teration risk was insurance and for Combination risk was countermeasures to reduce the im-pact of the risk factors themselves. Our evaluation showed that the silent cyber risk could be reduced by about 50%, thus demonstrating the effectiveness of the proposed countermeas-ures. We also investigated the risk assessment results of silent cyber risk from the operational perspective. Specifically, we applied portfolio management based on the return on invest-ment of risk countermeasures for silent cyber risks and found that proactive countermeasures tended to have higher priority.