1. Modelling of cyber attacks and economic incentives Per Håkon Meland

2. Main: How can threat models in combination with economic incentives improve cyber risk quantifications?
Which economic incentive models can be used to improve the likelihood component in cyber risk estimations? (descriptive)
What kind of data can be used as reliable input to models for economic incentives?
What are the possible sources of such data (current and future)?
How can generic threat models (and data) be specialized for individual organisations and/or domains? (normative)
How can cyber security be combined with traditional safety considerations in domain specific threat modelling techniques? (normative)
How can threat models be used to balance risk treatment options such as cyber insurance? (normative)
How can specific threat models contribute to predications for macro- economic cyber risks?
RQs

3. Design science research
Background
Security economics, e.g.:
Ross Andersson and Tyler Moore, The Economics of Information Security, Science, 2006.
Rainer Böhme and Gaile Schwartz, Modeling cyber- insurance: Towards a unifying framework, WEIS, 2010
Tyler Moore, Richard Clayton, and Ross Anderson. The economics of online crime. Journal of Economic Perspectives, 2009
Threat modelling, e.g.:
Bagnato, A., Kordy, B., Meland, P. H., & Schweitzer, P. (2012). Attribute decoration of attack–defense trees. International Journal of Secure Software Engineering
Shostack, A. (2014). Threat modeling: Designing for security. John Wiley & Sons.
Chen, Y., Boehm, B., & Sheppard, L. (2007, January). Value driven security threat modeling based on attack path analysis. HICSS 2007.
New artefact based on real-world problem
Problem identification
Literature research
Interviews with stakeholders
Solution design
Mixed approach data collection
Literature research II
Evaluation
Expert survey
Laboratory experiment
Case study