A Framework for Classifying and Comparing Models of Cyber Security Investment to Support Policy and Decision-Making.
Rachel Rue · WEIS · 2007
The threat to cyber security is real and growing. Organizations of all kinds must take protective measures, but effective resource allocat ion is difficult. This situation is due in part to uncertainty about the nature and severity o f threats and vulnerabilities, as well as about the effectiveness of mitigating measures. A v ariety of models have been proposed to aid decision makers. We describe a framework to analyze and compare models, and illustrate our framework with an analysis of three commonly-used types of models.