A risk analysis model to predict financial loss due to cyber attacks

Due to the increased reliance on interconnected computing systems and the rise in both number and sophistication of attacks on these systems, the protection of information assets is a critical function for all organizations. One of the most pressing issues within computer security is predicting the impact of cyberattacks. Companies are often unable to execute the essential function of forecasting their security losses for the purpose of resource allocation and planning. They struggle to make rational decisions backed by quantitative data. This paper presents a model for the prediction of financial losses in organizations based on Markov Modeling; a consistent and objective quantitative technique. The focus and intent is to use this model to show the probability of the effect of cyberattacks. This Markov Model defines three states, each of which represents the level of monetary loss the company incurs due to attacks. Losses are normalized by the annual revenue of a company and corrected for systematic increases over time. The model will allow companies to determine the probability that their organization's risk of financial loss due to attacks will remain static or transition to a different level over a defined period of time. This paper describes the model and the data collection and analysis techniques to calibrate the model.