Search

Proper evaluation of the risk associated to a cyber attack is a crucial aspect for many companies. There is an increasing need to plan for and implement effective ways to address cyber security, data security, and privacy protection. Estimating the risk of a successful cyber attack is an important issue, since this type of threat is proliferating and thus poses increasing danger to companies and the customers who use their services. While quantitative loss data are rarely available, it is possible to obtain a qualitative evaluation on an ordinal scale of severity of cyber attacks from experts of the sector. Hence, it is natural to apply order response models for the analysis of cyber risk. In particular, we rely on cumulative link models. We explain the experts' assessment of the severity of a cyber attack as a function of a set of explanatory variables describing the characteristics of the attack under consideration. A measure of diffusion of the effects of the attacks obtained via the use of a network structure is also incorporated into the set of explanatory variables of the model. Along with the description of the methodology, we present a detailed analysis of a real data set that includes information on serious cyber attacks occurred worldwide in the period 2017-2018.

In today's increasingly digitalized world, where organizations face the constant impact of technological advancements, the proliferation of cyber attacks poses a significant threat across various industries. While quantitative loss data is often scarce, experts in the field can provide a qualitative assessment of cyber attack severity on an ordinal scale. To analyze cyber risk effectively, it is natural to employ order response models. These models allow for exploring how experts assess the severity of cyberattacks based on a range of explanatory variables that describe the attack’s characteristics. Additionally, a measure of the diffusion of attack effects is incorporated through a network structure into the model’s explanatory variables. Apart from describing the methodology behind these models, a comprehensive analysis of a real dataset is presented. This dataset includes information on serious cyber attacks that have occurred worldwide, offering valuable insights into the practical application of the approach. By unravelling the complexities of cyber risk assessment and leveraging ordinal data models, the aim is to empower organizations to better understand and mitigate the potential impact of cyberattacks

In the last years there have been a scholars increasing interest in cybersecurity risk measurement, data security, and privacy protection. Since quantitative loss data are rarely available, we deal with ordinal data representing experts’ evaluation of the severity of the attacks. Due to the ordinal nature of the available data, it turns natural to rely on cumulative link models that allows us to express the cumulative probabilities associated with the different severity levels as a non linear function of a suitable set of explanatory variables. We evaluate the effect of each explanatory categorical variable on the risk level using the Average Marginal Effect. We apply our model to a real data set that includes information on serious cyber attacks occurred worldwide in 2018.