A framework for quantifying cyber security risks
Reinder Wolthuis, Frank Phillipson, Hidde-Jan Jongsma, Peter Langenkamp · Cyber security. · 2021
Recent years have seen an increasing amount of information becoming available which is of benefit to the security risk process. Traditionally, security risk management is an asset-based, qualitative process based on expert opinion and information at hand; periodically a group of experts assesses applicable risks and determines correct risk levels and whether new risks should be added to the list. This paper proposes a threat-based, traceable quantitative risk management approach that uses current information to quantify risks. This leads to a near real-time risk process, where available information is processed, and the risks are automatically updated. The approach was tested in practice at the main banks in the Netherlands.