Enterprise Cyber Threat Modeling and Simulation of Loss Events for Cyber Risk Quantification
Christian Ellerhold, Johann Schnagl, Thomas Schreck · 2023
In today's enterprise landscape, effective risk management has emerged as a vital cornerstone. This importance has escalated significantly due to the widespread transition from traditional on-premise infrastructures to dynamic cloud environments. Many organizations rely on qualitative approaches for internal IT and cyber risk management; however, these approaches have notable drawbacks, such as a lack of accuracy and comparability. In this paper, we propose a novel approach to address these limitations by using the Factor Analysis of Information Risk (FAIR) methodology in conjunction with MITRE ATT&CK to model realistic cyberattacks on organizations and measure quantitative risk. We describe how this approach can be used to create an enterprise cyber threat model, providing a case study for a cloud scenario to demonstrate its usage and to illustrate its potential benefits.