Modelling of cyber attacks and economic incentives Per Håkon Meland

Main: How can threat models in combination with economic incentives improve cyber risk quantifications? Which economic incentive models can be used to improve the likelihood component in cyber risk estimations? (descriptive) What kind of data can be used as reliable input to models for economic incentives? What are the possible sources of such data (current and future)? How can generic threat models (and data) be specialized for individual organisations and/or domains? (normative) How can cyber security be combined with traditional safety considerations in domain specific threat modelling techniques? (normative) How can threat models be used to balance risk treatment options such as cyber insurance? (normative) How can specific threat models contribute to predications for macro- economic cyber risks? RQs

Design science research Background Security economics, e.g.: Ross Andersson and Tyler Moore, The Economics of Information Security, Science, 2006. Rainer Böhme and Gaile Schwartz, Modeling cyber- insurance: Towards a unifying framework, WEIS, 2010 Tyler Moore, Richard Clayton, and Ross Anderson. The economics of online crime. Journal of Economic Perspectives, 2009 Threat modelling, e.g.: Bagnato, A., Kordy, B., Meland, P. H., & Schweitzer, P. (2012). Attribute decoration of attack–defense trees. International Journal of Secure Software Engineering Shostack, A. (2014). Threat modeling: Designing for security. John Wiley & Sons. Chen, Y., Boehm, B., & Sheppard, L. (2007, January). Value driven security threat modeling based on attack path analysis. HICSS 2007. New artefact based on real-world problem Problem identification Literature research Interviews with stakeholders Solution design Mixed approach data collection Literature research II Evaluation Expert survey Laboratory experiment Case study