Recent Findings from Eindhoven University of Technology Provide New Insights into Risk Management (Security Events and Vulnerability Data for…

Recent Findings from Eindhoven University of Technology Provide New Insights into Risk Management (Security Events and Vulnerability Data for Cybersecurity Risk Estimation)

By a News Reporter-Staff News Editor at Insurance Weekly News -- Current study results on Risk Management have been published. According to news reporting from Eindhoven, Netherlands, by VerticalNews journalists, research stated, "Current industry standards for estimating cybersecurity risk are based on qualitative risk matrices as opposed to quantitative risk estimates. In contrast, risk assessment in most other industry sectors aims at deriving quantitative risk estimations (e.g., Basel II in Finance)."

Financial support for this research came from Seventh Framework Programme.

The news correspondents obtained a quote from the research from the Eindhoven University of Technology, "This article presents a model and methodology to leverage on the large amount of data available from the IT infrastructure of an organization's security operation center to quantitatively estimate the probability of attack. Our methodology specifically addresses untargeted attacks delivered by automatic tools that make up the vast majority of attacks in the wild against users and organizations. We consider two-stage attacks whereby the attacker first breaches an Internet-facing system, and then escalates the attack to internal systems by exploiting local vulnerabilities in the target. Our methodology factors in the power of the attacker as the number of 'weaponized' vulnerabilities he/she can exploit, and can be adjusted to match the risk appetite of the organization."

According to the news reporters, the research concluded: "We illustrate our methodology by using data from a large financial institution, and discuss the significant mismatch between traditional qualitative risk assessments and our quantitative approach."

For more information on this research see: Security Events and Vulnerability Data for Cybersecurity Risk Estimation. Risk Analysis, 2017;37(8):1606-1627. (Wiley-Blackwell - www.wiley.com/; Risk Analysis - onlinelibrary.wiley.com/journal/10.1111/(ISSN)1539-6924)

Our news journalists report that additional information may be obtained by contacting L. Allodi, Faculty of Mathematics and Computer Science, Eindhoven University of Technology, Eindhoven, Netherlands.

Keywords for this news article include: Europe, Eindhoven, Netherlands, Risk Management.

Our reports deliver fact-based news of research and discoveries from around the world. Copyright 2017, NewsRx LLC