cyber security investment in the age of big datacritis2016.org/img/pdf/5b_4_cyber_security... ·...

Cyber Security Investment in the Age of Big Data: Reassessment of the Gordon-Loeb Model and Application to Critical

Infrastructure Protection

Dimitri Percia Davidab, Marcus Matthias Keuppb, Solange

Ghernaoutia, and Alain Mermoudab

a Swiss Cybersecurity Advisory and Research Group, University of Lausanne b Military Academy at ETH Zurich

2 / 15

Agenda

Introduction 2’

The economics of information security

Investigating investment dynamics in cybersecruity

Extending the GL model 8’

The impact of Big Data Analytics on the GL model

Suggesting a multi-period model

Relaxing the assumption of continuity

Application to Critical Infrastructure Protection 2’

Concluding comments 2’

Further research 1’

Q&A and discussion 5’

3 / 15

Introduction

Economics of Information Security as a complementary approach

Cyber Security issues = bad incentives + bad design

4 / 15

Introduction

Investigating investment dynamics in cybersecruity

SINGLE PERIOD MODEL

5 / 15

Introduction

Investigating investment dynamics in cybersecruity

MULTI-PERIOD MODEL

Cost of cyber security failure, S(Z, v)L

Cost DISCONTINUOUS FUNCTION

6 / 15

Extending the GL model

The impact of Big Data Analytics on the GL model

Security Analytics: from bad signatures to bad actions

MINIMIZING COSTS

CONVENTIONAL CYBERSECURITY MEANS LIMITED SUCCESS

7 / 15

Extending the GL model

The impact of Big Data Analytics on the GL model

Security Analytics: from bad signatures to bad actions

BAD SIGNATURES BAD ACTIONS

8 / 15

Extending the GL model

The impact of Big Data Analytics on the GL model

From resilience to anticipation: the next generation of information technologies

Real time analytics

Early warnings

Dynamic detection

9 / 15

Extending the GL model

1st impact: Suggesting a multi-period model

10 / 15

Extending the GL model

2nd impact: Relaxing the assumption of continuity

Cost of cyber security failure, S(Z, v)L

Cost of cyber security investment, Z

Total cost, Z+S(Z, v)L

Optimal cyber security investment Cost

Optimal amount of cyber security investment, Z* Investment

11 / 15

Extending the GL model

2nd impact: Relaxing the assumption of continuity

12 / 15

Application to CIP

An urgent need for efficiency and effectiveness improvement

13 / 15

Concluding comments

Extending the GL model for radically innovative and disruptive technologies

Cost of cyber security failure, S(Z, v)L

Cost of cyber security investment, Z

Total cost, Z+S(Z, v)L

Cost

Optimal amount of cyber security investment, Z*

14 / 15

Further research

A game theory experiment for collecting data

An econometric model for testing our hypothesis

15 / 15

Q&A and discussion